24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 64:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T491,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Dropper.Generic Sample 18af770d03b7… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 18af770d03b7…. Malware family: Dropper.Generic. Threat score 100/100. 6/27 AV engines flagged this file. 5 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/18af770d03b741bee7d43e2630e9b90390063fece166bca61d919e96ded302ac","keywords":["Malicious","Dropper.Generic","malware analysis","sandbox report","threat intelligence","18af770d03b741bee7d43e2630e9b90390063fece166bca61d919e96ded302ac"],"about":{"@type":"SoftwareApplication","name":"default.dat","applicationCategory":["peexe","64bits","executable"],"identifier":"18af770d03b741bee7d43e2630e9b90390063fece166bca61d919e96ded302ac","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Dropper.Generic","antivirusDetections":{"malicious":6,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T10c1,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00001500.00000000.269834.AF050000.00000004.mdmp, 00000000-00001500.00000000.269834.C93C0000.00000004.mdmp, 00000000-00001500.00000000.269834.C9A30000.00000004.mdmp, 00000000-00001500.00000001.270019.AF050000.00000004.mdmp") Found string ":\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation.ni.dll" (Source: "00000000-00001500.00000000.269834.AF050000.00000004.mdmp, 00000000-00001500.00000001.270019.AF050000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00001500.00000000.269834.AF050000.00000004.mdmp, 00000000-00001500.00000001.270019.AF050000.00000004.mdmp") Found string ".0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00001500.00000000.269834.C93C0000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" (Source: "00000000-00001500.00000000.269834.C93C0000.00000004.mdmp, 00000000-00001500.00000000.269834.C9A30000.00000004.mdmp") Found string "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" (Source: "00000000-00001500.00000000.269834.C93C0000.00000004.mdmp") Found string "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" (Source: "00000000-00001500.00000000.269834.C93C0000.00000004.mdmp") Found string "ile:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Management.Automation/v4.0_3.0.0.0__31bf3856ad364e35/System.Management.Automation.dll" (Source: "00000000-00001500.00000000.269834.C93C0000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" (Source: "00000000-00001500.00000000.269834.C93C0000.00000004.mdmp, 00000000-00001500.00000000.269834.C9A30000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=MSIL" (Source: "00000000-00001500.00000000.269834.C9A30000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00001500.00000001.270019.AF050000.00000004.mdmp") Found string "Verb attribute is equivalent to the verbName parameter of System.Management.Automation.CmdletAttribute constructor." (Source: "00000000-00001500.00000001.270019.C13C0000.00000004.mdmp") Found string "Noun attribute is equivalent to the nounName parameter of System.Management.Automation.CmdletAttribute constructor." (Source: "00000000-00001500.00000001.270019.C13C0000.00000004.mdmp") Found string "ConfirmImpact attribute is equivalent to the ConfirmImpact property of System.Management.Automation.CmdletAttribute." (Source: "00000000-00001500.00000001.270019.C13C0000.00000004.mdmp") Found string "Presence of the ConfirmImpact attribute is equivalent to setting to true the SupportsShouldProcess property of System.Management.Automation.CmdletAttribute." (Source: "00000000-00001500.00000001.270019.C13C0000.00000004.mdmp") Found string "HelpUri attribute is equivalent to the HelpUri property of System.Management.Automation.CmdletAttribute" (Source: "00000000-00001500.00000001.270019.C13C0000.00000004.mdmp") Found string "ETSType attribute is equivalent to System.Management.Automation.PSTypeNameAttribute." (Source: "00000000-00001500.00000001.270019.C13C0000.00000004.mdmp") Found string "" (Source: "00000000-00001500.00000001.270019.C13C0000.00000004.mdmp") file/memory contains long string(Source: "00000000-00001500.00000001.270019.C13C0000.00000004.mdmp") Found string "if ($__cmdletization_objectModelWrapper -is [System.Management.Automation.IDynamicParameters])" (Source: "00000000-00001500.00000001.270019.C13C0000.00000004.mdmp") Found string "([System.Management.Automation.IDynamicParameters]$__cmdletization_objectModelWrapper).GetDynamicParameters()" (Source: "00000000-00001500.00000001.270019.C13C0000.00000004.mdmp")26:T578,file/memory contains long string(File: "_lzma.pyd") file/memory contains long string(File: "_bz2.pyd") Found string "system.io.compression" (Source: "00000000-00001500.00000000.269834.891C0000.00000004.mdmp, 00000000-00001500.00000001.270019.891A0000.00000004.mdmp") Found string "compressiontracingswitchlevel" (Source: "00000000-00001500.00000000.269834.891C0000.00000004.mdmp") Found string "compressiontracingswitch" (Source: "00000000-00001500.00000000.269834.891C0000.00000004.mdmp") Found string "compressionmode" (Source: "00000000-00001500.00000001.270019.891A0000.00000004.mdmp") Found string "decompressionmethods" (Source: "00000000-00001500.00000001.270019.891A0000.00000004.mdmp") Found string "compressionlevel" (Source: "00000000-00001500.00000001.270019.891A0000.00000004.mdmp") Found string "compressionstrategy" (Source: "00000000-00001500.00000001.270019.891A0000.00000004.mdmp") Found string "compressionmethod" (Source: "00000000-00001500.00000001.270019.891A0000.00000004.mdmp") Found string "system.io.compression" (Source: "00000000-00001972.00000000.266225.891D0000.00000004.mdmp, 00000000-00001972.00000001.266433.891B0000.00000004.mdmp") Found string "compressiontracingswitchlevel" (Source: "00000000-00001972.00000000.266225.891D0000.00000004.mdmp") Found string "compressiontracingswitch" (Source: "00000000-00001972.00000000.266225.891D0000.00000004.mdmp")27:T10ea,Found reference string "%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\'""" (Indicator: "add-mppreference"; Source: "00000000-00006252-00000C46-26011903966") Found reference string "%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath '%PUBLIC%\Videos\qeyupihi'""" (Indicator: "add-mppreference"; Source: "00000000-00006252-00000C46-48213026554") Found reference string "%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath '%TEMP%\""" (Indicator: "add-mppreference"; Source: "00000000-00006252-00000C46-70005546144") Found reference string "%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""" (Indicator: "add-mppreference"; Source: "00000000-00006252-00000C46-91523845426") Found reference string "%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""" (Indicator: "add-mppreference"; Source: "00000000-00006252-00000C46-116117695928") Found reference string "%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""" (Indicator: "add-mppreference"; Source: "00000000-00006252-00000C46-139974245840") Found reference string "%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""" (Indicator: "add-mppreference"; Source: "00000000-00006252-00000C46-161564745186") Found reference string "%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""" (Indicator: "add-mppreference"; Source: "00000000-00006252-00000C46-182526290580") Found reference string "%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""" (Indicator: "add-mppreference"; Source: "00000000-00006252-00000C46-203956366768") Found reference string "powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"" (Indicator: "add-mppreference"; Source: "00000000-00004660-00000C46-1433431174") Found reference string "powershell -Command "Add-MpPreference -ExclusionPath '%PUBLIC%\Videos\qeyupihi'"" (Indicator: "add-mppreference"; Source: "00000000-00005000-00000C46-1400969670") Found reference string "powershell -Command "Add-MpPreference -ExclusionPath '%TEMP%\"" (Indicator: "add-mppreference"; Source: "00000000-00003048-00000C46-1280601110"), Found reference string "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"" (Indicator: "add-mppreference"; Source: "00000000-00007688-00000C46-1335653236"), Found reference string "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"" (Indicator: "add-mppreference"; Source: "00000000-00007428-00000C46-1868377158"), Found reference string "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"" (Indicator: "add-mppreference"; Source: "00000000-00001468-00000C46-1371318636"), Found reference string "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"" (Indicator: "add-mppreference"; Source: "00000000-00007972-00000C46-1291961194"), Found reference string "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"" (Indicator: "add-mppreference"; Source: "00000000-00006124-00000C46-1522015666"), Found reference string "/c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\'""" (Indicator: "add-mppreference"; File: "cmd.exe"), Found reference string "/c "powershell -Command "Add-MpPreference -ExclusionPath '%PUBLIC%\Videos\qeyupihi'""" (Indicator: "add-mppreference"; File: "cmd.exe"), Found reference string "/c "powershell -Command "Add-MpPreference -ExclusionPath '%TEMP%\""" (Indicator: "add-mppreference"; File: "cmd.exe"), Found reference string "/c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""" (Indicator: "add-mppreference"; File: "cmd.exe"), Found reference string "/c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""" (Indicator: "add-mppreference"; File: "cmd.exe"), Found reference string "/c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""" (Indicator: "add-mppreference"; File: "cmd.exe"), Found reference string "/c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""" (Indicator: "add-mppreference"; File: "cmd.exe"), Found reference string "/c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""" (Indicator: "add-mppreference"; File: "cmd.exe")28:T890,file/memory contains long string with (Indicator: "SHA384"; File: "libffi-8.dll") file/memory contains long string with (Indicator: "SHA384"; File: "_bz2.pyd") file/memory contains long string with (Indicator: "HMAC"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA512"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_wmi.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "select.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_uuid.pyd") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00001972-00000BC0-3154645056") Found reference to "HMAC_CTX_new" (Indicator: "HMAC"; File: "18af770d03b741bee7d43e2630e9b90390063fece166bca61d919e96ded302ac.bin") Found reference to "HMAC_Init_ex" (Indicator: "HMAC"; File: "18af770d03b741bee7d43e2630e9b90390063fece166bca61d919e96ded302ac.bin") Found reference to "HMAC_Final" (Indicator: "HMAC"; File: "18af770d03b741bee7d43e2630e9b90390063fece166bca61d919e96ded302ac.bin") Found reference to "HMAC_Update" (Indicator: "HMAC"; File: "18af770d03b741bee7d43e2630e9b90390063fece166bca61d919e96ded302ac.bin") Found reference to "HMAC_CTX_get_md" (Indicator: "HMAC"; File: "18af770d03b741bee7d43e2630e9b90390063fece166bca61d919e96ded302ac.bin") Found reference to "PKCS5_PBKDF2_HMAC" (Indicator: "HMAC"; File: "18af770d03b741bee7d43e2630e9b90390063fece166bca61d919e96ded302ac.bin") Found reference to "HMAC_CTX_free" (Indicator: "HMAC"; File: "18af770d03b741bee7d43e2630e9b90390063fece166bca61d919e96ded302ac.bin") Found reference to "HMAC_CTX_copy" (Indicator: "HMAC"; File: "18af770d03b741bee7d43e2630e9b90390063fece166bca61d919e96ded302ac.bin") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00001500.00000000.269834.AF050000.00000004.mdmp, 00000000-00001500.00000001.270019.AF050000.00000004.mdmp") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00001972.00000000.266225.AD010000.00000004.mdmp, 00000000-00001972.00000001.266433.AD010000.00000004.mdmp")29:Ta6d,"powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D23209AD23D314232174E40D7F9D62139786633A") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D4DE20D05E66FC53FE1A50882C78DB2852CAE474") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D4DE20D05E66FC53FE1A50882C78DB2852CAE474") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D69B561148F01C77C54578C10926DF5B856976AD") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D69B561148F01C77C54578C10926DF5B856976AD") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D8C5388AB7301B1B6ED47AE645253A6F9F1A2761") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D8C5388AB7301B1B6ED47AE645253A6F9F1A2761") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DAC9024F54D8F6DF94935FB1732638CA6AD77C13") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DAC9024F54D8F6DF94935FB1732638CA6AD77C13") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DE28F4A4FFE5B92FA3C503D1A349A7F9962A8212") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DE28F4A4FFE5B92FA3C503D1A349A7F9962A8212") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DF646DCB7B0FD3A96AEE88C64E2D676711FF9D5F") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DF646DCB7B0FD3A96AEE88C64E2D676711FF9D5F")2a:Ta71,"d__198" (Indicator: "base64"; Source: "00000000-00001500.00000000.269834.89280000.00000004.mdmp, 00000000-00001500.00000001.270019.89280000.00000004.mdmp") Found string "d__148" (Indicator: "base64"; Source: "00000000-00001500.00000000.269834.89280000.00000004.mdmp, 00000000-00001500.00000001.270019.89280000.00000004.mdmp") Found string "d__151" (Indicator: "base64"; Source: "00000000-00001500.00000000.269834.89280000.00000004.mdmp, 00000000-00001500.00000001.270019.89280000.00000004.mdmp") Found string "d__484" (Indicator: "base64"; Source: "00000000-00001500.00000000.269834.89280000.00000004.mdmp, 00000000-00001500.00000001.270019.89280000.00000004.mdmp") Found string "d__110" (Indicator: "base64"; Source: "00000000-00001500.00000000.269834.89280000.00000004.mdmp, 00000000-00001500.00000001.270019.89280000.00000004.mdmp") Found string "d__37" (Indicator: "base64"; Source: "00000000-00001500.00000000.269834.89280000.00000004.mdmp, 00000000-00001500.00000001.270019.89280000.00000004.mdmp") Found string "d__487" (Indicator: "base64"; Source: "00000000-00001500.00000000.269834.89280000.00000004.mdmp, 00000000-00001500.00000001.270019.89280000.00000004.mdmp")56:T734,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "18af770d03b741bee7d43e2630e9b90390063fece166bca61d919e96ded302ac.bin") Found reference to API "K32EnumProcessModules" (Indicator: "EnumProcessModules"; File: "18af770d03b741bee7d43e2630e9b90390063fece166bca61d919e96ded302ac.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "18af770d03b741bee7d43e2630e9b90390063fece166bca61d919e96ded302ac.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "18af770d03b741bee7d43e2630e9b90390063fece166bca61d919e96ded302ac.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "18af770d03b741bee7d43e2630e9b90390063fece166bca61d919e96ded302ac.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "18af770d03b741bee7d43e2630e9b90390063fece166bca61d919e96ded302ac.bin") Found reference to API "Process32First" (Indicator: "Process32First"; File: "18af770d03b741bee7d43e2630e9b90390063fece166bca61d919e96ded302ac.bin") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; File: "18af770d03b741bee7d43e2630e9b90390063fece166bca61d919e96ded302ac.bin") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "18af770d03b741bee7d43e2630e9b90390063fece166bca61d919e96ded302ac.bin") Found reference to API "Thread32First" (Indicator: "Thread32First"; File: "18af770d03b741bee7d43e2630e9b90390063fece166bca61d919e96ded302ac.bin") Found reference to API "Process32Next" (Indicator: "Process32Next"; File: "18af770d03b741bee7d43e2630e9b90390063fece166bca61d919e96ded302ac.bin") Found reference to API "EnumProcesses" (Indicator: "EnumProcesses"; File: "18af770d03b741bee7d43e2630e9b90390063fece166bca61d919e96ded302ac.bin")57:T7fa,Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00001500.00000000.269834.891C0000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00001500.00000000.269834.891C0000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00001500.00000000.269834.89260000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00001500.00000000.269834.89260000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00001500.00000000.269834.89260000.00000004.mdmp") Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00001500.00000001.270019.89180000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00001500.00000001.270019.891A0000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00001500.00000001.270019.891A0000.00000004.mdmp") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00001500.00000001.270019.89220000.00000004.mdmp") Found string "adminpasswordstatus" (Indicator: "password"; Source: "00000000-00001500.00000001.270019.892A0000.00000004.mdmp") Found string "resetcomputermachinepasswordcommand" (Indicator: "password"; Source: "00000000-00001500.00000001.270019.892A0000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00001500.00000001.270019.C94A4000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00001972.00000000.266225.891D0000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00001972.00000000.266225.891D0000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00001972.00000000.266225.89290000.00000004.mdmp, 00000000-00001972.00000001.266433.89290000.00000004.mdmp")58:T508,Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00001500.00000000.269834.AF050000.00000004.mdmp, 00000000-00001500.00000001.270019.AF050000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001500.00000000.269834.C93C0000.00000004.mdmp, 00000000-00001500.00000001.270019.C93C0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\Device\"; Source: "00000000-00001500.00000000.269834.C9A30000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\DosDevices\"; Source: "00000000-00001500.00000000.269834.C9A30000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00001972.00000000.266225.92B10000.00000004.mdmp, 00000000-00001972.00000001.266433.92B10000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001972.00000000.266225.AD010000.00000004.mdmp, 00000000-00001972.00000001.266433.AD010000.00000004.mdmp")59:T97c,"