21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 41:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T41f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 2ef95cd2ef6b… — Score 85/100 — Hybrid Analysis","description":"Malicious verdict for sample 2ef95cd2ef6b…. Threat score 85/100. 0/26 AV engines flagged this file. 4 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b"],"about":{"@type":"SoftwareApplication","name":"evidencelumber.bat","applicationCategory":["script","bat"],"identifier":"2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b","additionalType":"Malicious sample"},"threatScore":85,"antivirusDetections":{"malicious":0,"total":26},"behavioralIndicators":{"malicious":4,"suspicious":6},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T18ad,"cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007820) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007820) "reg.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000404) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008000) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008000) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac5018fb7f0000000000000000000051ed421afb7f000000000000c901000000000000000000000348a2c2aaa500002a0000000000000080c1a784c90100008fec421afb7f0000e0ac5018fb7f0000e0ac5018fb7f0000000000000000000000000000fb7f0000ffffff7fba61000000000000000000000000000000000000d8ce4418fb7f00002a0000000000000069c3fd17fb7f00003100000000000000e803000000000000ec030000000000001100011000000000e0cfdfd4b000000003a3ea17fb7f0000e0cfdfd4b000000000000000000000002b00000000000000000000000000000020b00318fb7f0000b43f0218fb7f0000e0ce4418 (UID: 00000000-00008000) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000040000000000000000000c884c90100000b8e401afb7f00000000c884c901000002000000c9010000380000000000000040000000000000003003c884c901000018ded0d5b0000000010000000000000003000000000000000100000000000000160000000000000020108e84c9010000000000000000000000008e84c9010000301d429fc901000000000000000000008b0000000100000000000000000000008000000000000000040000000000000000000000000000002835429fc901000004000000000000003800000000000000f098e917fb7f00003800000000000000380000000000000090dfd0d5b0000000c00c5fe3fa7f000000000000 (UID: 00000000-00008000) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b0b401fb7f0000070000000000000000000000000000000100000000000000b03af39ec9010000000000000000000000c7f59ec90100004c98e917fb7f000070edf59ec9010000b3ce55e3fa7f000050cdf59ec9010000004fb401fb7f0000d0b0b401fb7f00000000000000000000000000000000000050cdf59ec9010000b03af39ec901000020f2f59ec9010000e8dfd0d5b00000004c98e917fb7f00000100000000000000e8dfd0d5b000000020f2f59ec901000050cdf59ec9010000010000000000000002bc55e3fa7f000070cbf59ec9010000c009f49ec9010000feffffff040000007df0b301fb7f000080f1f59e (UID: 00000000-00008000) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000070000000000000000000000000000000100000000000000b03af39ec9010000000000000000000000c7f59ec90100004c98e917fb7f000070e8f59ec9010000b3ce55e3fa7f0000a0cbf59ec9010000384fb401fb7f0000d0b0b401fb7f000000000000000000000000000000000000a0cbf59ec9010000b03af39ec901000020f2f59ec9010000e0dfd0d5b00000004c98e917fb7f00000100000000000000e0dfd0d5b000000020f2f59ec9010000a0cbf59ec9010000010000000000000002bc55e3fa7f00000000000000000000c009f49ec901000070cbf59e04000000feffffffffffffffb03af39ec90100007df0b301fb7f000000000000 (UID: 00000000-00008000) "powershell.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008000)23:Tb4cf,"cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007820) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007820) "reg.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000404) "reg.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000404) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter SHGetFileInfo (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter SHGetFileInfoW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CreateProcess (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00008000) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00008000)24:T47d,"cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\REG.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\SCHTASKS.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "")25:T4da,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp")26:T618e,Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameW"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "RegRestoreKeyW"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "RegLoadKeyW"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "RegUnLoadKeyW"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "RegSaveKeyExW"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "IsCharAlphaNumericW"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "RegFlushKey"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "LocalReAlloc"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "CharUpperW"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "RegConnectRegistryW"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "RegSaveKeyW"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyW"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpW"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "NtQueryKey"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "GetThreadLocale"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "StrStrIW"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00008000.00000000.164636.84980000.00000004.mdmp, 00000000-00008000.00000001.164745.84980000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp")27:T2b90,"cmd.exe" loaded module "KERNEL32" at base 7ffb19850000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffb16ae0000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffb16ae0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffb16ae0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffb199e0000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffb16ae0000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffb16ae0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffb16ae0000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffaf7840000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7ffb19850000 "cmd.exe" loaded module "NTDLL.DLL" at base 7ffb1a3e0000 "reg.exe" loaded module "KERNEL32" at base 7ffb19850000 "reg.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffb16ae0000 "reg.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffb16ae0000 "reg.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffb16ae0000 "reg.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffb199e0000 "reg.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffb16ae0000 "reg.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffb16ae0000 "reg.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffb16ae0000 "reg.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffaf7840000 "reg.exe" loaded module "KERNEL32.DLL" at base 7ffb19850000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffb16ae0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffb16ae0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffb16ae0000 "powershell.exe" loaded module "KERNEL32" at base 7ffb19850000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffaf7840000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ffb19850000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ffb17d20000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffaf1530000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 1c9865e0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffb16750000 "powershell.exe" loaded module "VERSION.DLL" at base 7ffb0db90000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffae9d20000 "powershell.exe" loaded module "USER32.DLL" at base 7ffb1a1f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffb16ae0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffaf3520000 "powershell.exe" loaded module "NTDLL" at base 7ffb1a3e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffb19c40000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ffb17c00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ffae8720000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 7ffb19a10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffb19c40000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ffb19b70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ffae7ab0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ffae7030000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffaf13c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffb15bd0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffb17790000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffae4fc0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 7ffb19c40000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffb19c40000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 7ffb1a3e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base 7ffb17f20000 "powershell.exe" loaded module "PSAPI.DLL" at base 1c9866f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ffb167e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ffb167e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffb174c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\AMSI.DLL" at base 0 "powershell.exe" loaded module "AMSI.DLL" at base 7ffb02d30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffb0db90000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffb01b30000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ffb174c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\0EGFK1X9.DLL" at base 7ffaf5ad0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffaf1320000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffaf11b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffaf1040000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffae4710000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ffaf34c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ffae3da0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffae3a30000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffb16ae0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffae38e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffae3870000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffae3790000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffae3650000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffae3600000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 7ffb0cc00000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ffb16630000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WLDP.DLL" at base 0 "powershell.exe" loaded module "WLDP.DLL" at base 7ffb15820000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffb14d70000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffae3520000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffb19850000 "powershell.exe" loaded module "USERENV.DLL" at base 7ffb16660000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffb17d20000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ffb19c40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffae2810000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffaf7dc0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ffb1629000028:T416,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp")29:T8de,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00008000) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00008000) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00008000) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00008000) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00008000) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00008000) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00008000) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00008000) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00008000) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00008000) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00008000) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00008000) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00008000) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00008000) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00008000) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00008000) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00008000) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00008000) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00008000) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\* (UID: 00000000-00008000)2a:Tfc7,"reg.exe ADD HKCU\Environment /v UserInitMprLogonScript /t REG_SZ /d "C:\ProgramData\Essay\spcache.exe" /f" in Source: 00000000-00000404.00000000.164306.96AC0000.00000004.mdmp "HKCU\Environment" in Source: 00000000-00000404.00000000.164306.96AC0000.00000004.mdmp "HKCU\Environment" in Source: 00000000-00000404.00000000.164306.96DD0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00000404.00000000.164306.E702F000.00000002.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE" in Source: 00000000-00000404.00000000.164306.E702F000.00000002.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C296D07-90AE-4FAC" in Source: 00000000-00008000.00000000.164636.84980000.00000004.mdmp "1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{07" in Source: 00000000-00008000.00000000.164636.84980000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008000.00000000.164636.84980000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008000.00000000.164636.84980000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 024" in Source: 00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C296D07-90AE-4FAC" in Source: 00000000-00008000.00000001.164745.84980000.00000004.mdmp "1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{07" in Source: 00000000-00008000.00000001.164745.84980000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008000.00000001.164745.84980000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008000.00000001.164745.84980000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00008000.00000001.164745.9EDC0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00008000.00000001.164745.9EDC0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00008000.00000001.164745.9EE94000.00000004.mdmp2b:T101a,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00008000-00000C2E-944173450] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00008000-00000C2B-1535985546] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00008000-00000C2B-1536081632] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00008000-00000C2B-1536160640] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00008000-00000C2B-1536302733] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00008000-00000C2B-1536351698] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00008000-00000C2B-1536401438] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00008000-00000C2B-1536473367] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00008000-00000C2B-1536542830] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00008000-00000C2B-1536599320] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00008000-00000C2B-1536669504] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00008000-00000C2B-1536919692] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00008000-00000C2B-1537015049] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00008000-00000C2B-1537305491] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00008000-00000C2B-1537338616] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00008000-00000C2B-1537637515] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00008000-00000C2B-1537764631] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00008000-00000C2B-1537797228] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00008000-00000C2B-1537824053] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00008000-00000C2B-1537864291] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00008000-00000C2B-1538152883] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00008000-00000C2B-1538268058] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00008000-00000C2B-1538608390] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll" [Source: 00000000-00008000-00000C2B-1538682457] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll" [Source: 00000000-00008000-00000C2B-1538751335]2c:T468,Found string "\Device\HarddiskVolume2\Windows\System32\reg.exe" (Indicator: "\Device\"; Source: "00000000-00000404.00000000.164306.96AC0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00008000.00000000.164636.84980000.00000004.mdmp, 00000000-00008000.00000001.164745.84980000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00008000.00000000.164636.84980000.00000004.mdmp, 00000000-00008000.00000001.164745.84980000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\Device\"; Source: "00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\DosDevices\"; Source: "00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp")2d:Tee2,Found string "set UPSAWXZsrUNuvwG=PEUAGqnfhiTitAxLbpTFeV&&set ZDeKsvBTs=jsxOcAtmTOlmwCTWwdQWizUyZkCulLoHkdOju&&set twukPG=zaUAFRPzNhmtdkWEyUkljNXcpxFXzaPGLqCPOUnTFklHCK&&set DpswKLvcDo=fXVFqlgJkiBKvi&&set dtLvRueXePxxGHQ=DnZSBdrOVujLfwhDsLkAU" (Indicator: "set "; File: "2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b.bin") Found string "set xgFhBHYGtTcRmjP=MRYlgBdyjGJMKkaJihZoStjZusmN" (Indicator: "set "; File: "2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b.bin") Found string "set cxVkbSRdoQFkAj=fwGDRMwlfiXctXCklmCDTZXwGcyaaTOGCvvIjFjVUDRZfnHtATmTWDJeB" (Indicator: "set "; File: "2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b.bin") file/memory contains long string with (Indicator: "set "; File: "2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b.bin") Found string "set MybKXPsMl=LbybccqFrmhphepXwkJcFuDjKSvxWBBVobmXdHISNxE&&set dHFPMvsYqY=GLWIXBzeMMBVtspOntMWndBGfnndED" (Indicator: "set "; File: "2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b.bin") Found string "set RKZSttsejeDYWmh=FwXzDSOZBJSFnzFDjxsZYAuZpEIpKTXnAGOXhBXqitrcxnvHEXrkohRYBSu&&set ATDRTrwhMDBDjE=SATQnVMLoQckYZWLHvbjQSnNimaHtqDVapasLJzxnhLIUPIlwuRtu&&set Mrrtcdl=nSlVcDvJnaqvmFFNNh" (Indicator: "set "; File: "2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b.bin") Found string "set zCtpxysiDUiKPupbtN=PEHolfyRcycDMJYmAEvsnJmLJTvnDmOqHPRkKQvjP" (Indicator: "set "; File: "2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b.bin") Found string "set JJCstyKPlUCFLiU=diJYwIfPXIAdolXFFVlJOlSMyARTrqFHLPtmIpsww&&set nwfopy=uyIngqrUdknmAvdtYHHtP&&set tCmTQXOSOQdrd=IGjmhIGdVe&&set XmCPwQmPnI=xzohpmfjnpkIWZhQKysTRrVDOGGoco&&set fjOjOwjiEPu=eArekrkgvqMIabaSxznzSIWtpcswKTjWmLfEwaSxKbvxpBhWJUO" (Indicator: "set "; File: "2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b.bin") Found string "set bhBttKNhdCsClfH=MNYvkmzqItJhczgVkzvMyrIgWlqYfvxMbzmVq&&set VJQkha=BiPyCuQrHZnDTYLngkfOrSkBeRGkVyeEjhD&&set uargWLXheEgHHINjzL=CpZajIMfeRHPqNferRqsdRPrYe" (Indicator: "set "; File: "2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b.bin") Found string "set MQRpAaZfrwENojhDG=JPcJGPsaVCuPRbqwZHOktVLwhUUEQLginkzrYWiqpM" (Indicator: "set "; File: "2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b.bin") Found string "set skpkHPZwaQRgoI=BxPNlcvNaLy&&set kDpjGkluGCX=lDaunmruyNFKimpnOjfdwqNfZe&&set QVKOOtEeQTY=reTFFXBTGnBUeGJPElRsycRBZ" (Indicator: "set "; File: "2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b.bin") Found string "set AdnbOJ=jKKopJKPfQEePJLrRe" (Indicator: "set "; File: "2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b.bin") Found string "set zWCPtGCVLCRM=KGnWXNKcBtNgNchAcAVLeUfNMbtsJXGIN" (Indicator: "set "; File: "2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b.bin") Found string "set dRCjngscDUGvPsCoe=tMiaBOTxFWLVtODJEJbHgf" (Indicator: "set "; File: "2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b.bin") Found string "set nCjsB=kuxPQhPMhEamblmpXEtVy&&set Xjnfvu=ZDPVtfJJDNiJGIYnlFMPiNqPSajZdvyMutWGwbTQuohjDabKNlWIvuLZsN&&set AMhWet=cAzUTWBPiKqlhrMelXEOLaqOWJ" (Indicator: "set "; File: "2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b.bin") Found string "set gLtRUDsSAWizu=wUjdKfRtQVCUKgtXwfBJXUnYyvXfEjAWzZxqwiMyBSCJsFpUAifcnzCnZ&&set uZsARvYBNxKlSuo=muxegcEXhzzNeviRKBAUvMwtKBbswoMbGEXVOtPXqDuwZhoq&&set kRUFVuQIvJXInXfa=cHyeUKNpmZrrrp" (Indicator: "set "; File: "2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b.bin") Found string "set THKuvpLhtDjX=QFewpMQxLBABcZsjbqvdoED&&set kYXXp=SMFgqZsQwHCeFJjcsQYfjJsALkvZUIlvEbPWNIYVtJffBMHvhchdRm" (Indicator: "set "; File: "2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b.bin")2e:T32ad,"cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007820) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007820) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007820) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007820) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000404) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000404) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000404) "reg.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000404) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00008000) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00008000)2f:T492f,Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;f$eogtt3;r0m0xx4b1.3.6.1.4.1.311.10.3.30g6" - Source: "00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]8h" - Source: "00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1s0w&$" - Source: "00000000-00008000.00000000.164636.9EF30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00008000.00000000.164636.9EF30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt01/0-01(0&0p" - Source: "00000000-00008000.00000000.164636.9EF30000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00008000.00000001.164745.84980000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00008000.00000001.164745.9EDC0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00008000.00000001.164745.9EDC0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00008000.00000001.164745.9EDC0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00008000.00000001.164745.9EDC0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00008000.00000001.164745.9EDC0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00008000.00000001.164745.9EDC0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00008000.00000001.164745.9EDC0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;f$eogtt3;r0m0xx4b1.3.6.1.4.1.311.10.3.30g6" - Source: "00000000-00008000.00000001.164745.9EDC0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00008000.00000001.164745.9EDC0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00008000.00000001.164745.9EDC0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00008000.00000001.164745.9EDC0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00008000.00000001.164745.9EDC0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00008000.00000001.164745.9EDC0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]8h" - Source: "00000000-00008000.00000001.164745.9EDC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00008000.00000001.164745.9EDC0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00008000.00000001.164745.9EDC0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008000.00000001.164745.9EDC0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00008000.00000001.164745.9EDC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6w120531151137z0/^g(o-cejy" - Source: "00000000-00008000.00000001.164745.9EDC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00008000.00000001.164745.9EDC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00008000.00000001.164745.9EDC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0/t'!ntnz6704?nel32.dll," - Source: "00000000-00008000.00000001.164745.9EE94000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1s0w&$" - Source: "00000000-00008000.00000001.164745.9EF30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00008000.00000001.164745.9EF30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt01/0-01(0&0p" - Source: "00000000-00008000.00000001.164745.9EF30000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft" - Source: "00000000-00008000.00000001.164745.9F43E000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00008000.00000001.164745.9F43E000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1l0j" - Source: "00000000-00008000.00000001.164745.9F43E000.00000004.mdmp") Found URL "http://www.microsoft.com/windows" - Source: "00000000-00008000.00000001.164745.9F43E000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00008000.00000001.164745.9F464000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00008000.00000001.164745.9F464000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00008000.00000001.164745.9F464000.00000004.mdmp")30:T426,"powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA")31:Taee,"cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "CMD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: "DISABLECMD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COMMAND PROCESSOR"; Key: "DISABLEUNCCHECK"; Value: "")32:T9ee,"cmd.exe" trying to access non-existent file "C:\REG.EXE" "cmd.exe" trying to access non-existent file "C:\reg.exe" "cmd.exe" trying to access non-existent file "C:\POWERSHELL.EXE" "cmd.exe" trying to access non-existent file "C:\powershell.exe" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\OLEAUT32.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\BCRYPT.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\bcrypt.dll"33:T79a,Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00000404.00000000.164306.E702F000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00008000.00000000.164636.01B42000.00000002.mdmp")34:T91a,"cmd.exe" queried SystemProcessInformation at 00000000-00007820-00000C15-1529178257 [PID: 7820] "cmd.exe" queried SystemProcessInformation at 00000000-00007820-00000C15-1529186709 [PID: 7820] "cmd.exe" queried SystemProcessInformation at 00000000-00007820-00000C15-1529444846 [PID: 7820] "cmd.exe" queried SystemProcessInformation at 00000000-00007820-00000C15-1529455408 [PID: 7820] "reg.exe" queried SystemProcessInformation at 00000000-00000404-00000C15-1530107752 [PID: 404] "reg.exe" queried SystemProcessInformation at 00000000-00000404-00000C15-1530115350 [PID: 404] "reg.exe" queried SystemProcessInformation at 00000000-00000404-00000C15-1530369749 [PID: 404] "reg.exe" queried SystemProcessInformation at 00000000-00000404-00000C15-1530384599 [PID: 404] "powershell.exe" queried SystemProcessInformation at 00000000-00008000-00000C15-1535349766 [PID: 8000] "powershell.exe" queried SystemProcessInformation at 00000000-00008000-00000C15-1535359463 [PID: 8000] "powershell.exe" queried SystemProcessInformation at 00000000-00008000-00000C15-1536697411 [PID: 8000] "powershell.exe" queried SystemProcessInformation at 00000000-00008000-00000C15-1536705910 [PID: 8000] "powershell.exe" queried SystemProcessInformation at 00000000-00008000-00000C15-1537475980 [PID: 8000] "powershell.exe" queried SystemProcessInformation at 00000000-00008000-00000C15-1537484556 [PID: 8000] "powershell.exe" queried SystemProcessInformation at 00000000-00008000-00000C15-1537894411 [PID: 8000] "powershell.exe" queried SystemProcessInformation at 00000000-00008000-00000C15-1537903201 [PID: 8000] "powershell.exe" queried SystemProcessInformation at 00000000-00008000-00000C15-1538400133 [PID: 8000] "powershell.exe" queried SystemProcessInformation at 00000000-00008000-00000C15-1538408775 [PID: 8000] "powershell.exe" queried SystemProcessInformation at 00000000-00008000-00000C15-1538899118 [PID: 8000] "powershell.exe" queried SystemProcessInformation at 00000000-00008000-00000C15-1539587768 [PID: 8000] "powershell.exe" queried SystemProcessInformation at 00000000-00008000-00000C15-1539600552 [PID: 8000] "powershell.exe" queried SystemProcessInformation at 00000000-00008000-00000C15-1540270995 [PID: 8000] "powershell.exe" queried SystemProcessInformation at 00000000-00008000-00000C15-1540279524 [PID: 8000]35:Tb0d,"powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\PHYSICALSTORES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\PHYSICALSTORES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS\27748148BBE67A43CDBFEC6C3784862CE134E6EA") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\DISALLOWED\PHYSICALSTORES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\DISALLOWED\")36:Tdbe,"reg.exe ADD HKCU\Environment /v UserInitMprLogonScript /t REG_SZ /d "%ALLUSERSPROFILE%\Essay\spcache.exe" /f" in Source: 00000000-00007820-00000C47-2093665838 "ADD HKCU\Environment /v UserInitMprLogonScript /t REG_SZ /d "%ALLUSERSPROFILE%\Essay\spcache.exe" /f" in Source: reg.exe "reg.exe ADD HKCU\Environment /v UserInitMprLogonScript /t REG_SZ /d "C:\ProgramData\Essay\spcache.exe" /f" in Source: 00000000-00000404.00000000.164306.96AC0000.00000004.mdmp "HKCU\Environment" in Source: 00000000-00000404.00000000.164306.96AC0000.00000004.mdmp 00000000-00000404.00000000.164306.96DD0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00000404.00000000.164306.E702F000.00000002.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE" in Source: 00000000-00000404.00000000.164306.E702F000.00000002.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C296D07-90AE-4FAC" in Source: 00000000-00008000.00000000.164636.84980000.00000004.mdmp 00000000-00008000.00000001.164745.84980000.00000004.mdmp "1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{07" in Source: 00000000-00008000.00000000.164636.84980000.00000004.mdmp 00000000-00008000.00000001.164745.84980000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008000.00000000.164636.84980000.00000004.mdmp 00000000-00008000.00000001.164745.84980000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008000.00000000.164636.84980000.00000004.mdmp 00000000-00008000.00000001.164745.84980000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp 00000000-00008000.00000001.164745.9EDC0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp 00000000-00008000.00000001.164745.9EDC0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 024" in Source: 00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00008000.00000001.164745.9EE94000.00000004.mdmp37:T1646,Pattern match: "http://www.validationtest.contoso.com/test%d.html" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ntrust.net" Pattern match: "microsoft.net/assembly/gac_msil/system.management.automation/v4.0_3.0.0.0__31bf3856ad364e35/system.management.automation.dll" Heuristic match: "6299.15.cat" Pattern match: "www.digicert.com1$0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "http://www.microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "icrosoft.com/pki" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "http://www.microsoft.com/windows" Pattern match: "http://go.microsoft.com/fwlink/?linkid=42127" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "5.cat" Pattern match: "microsoft.net/assembly/gac_64/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscorlib.dll" Heuristic match: "??\c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "icrosoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "osoft.com/pki/" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings"38:Ta24,"cmd.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" "powershell.exe" trying to access non-existent file "Z:\" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.XAML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.xaml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.psd1"39:T623,Found registry query API: "RegQueryValueExW" in "00000000-00000404.00000000.164306.E702F000.00000002.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00000404.00000000.164306.E702F000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00000404.00000000.164306.E702F000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00000404.00000000.164306.E702F000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00000404.00000000.164306.E702F000.00000002.mdmp" Found registry query API: "RegSaveKeyExW" in "00000000-00000404.00000000.164306.E702F000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00000404.00000000.164306.E702F000.00000002.mdmp" Found registry query API: "RegOpenKeyW" in "00000000-00000404.00000000.164306.E702F000.00000002.mdmp" Found registry query API: "RegSaveKeyW" in "00000000-00000404.00000000.164306.E702F000.00000002.mdmp" Found registry query API: "RegEnumKeyW" in "00000000-00000404.00000000.164306.E702F000.00000002.mdmp" Found registry query API: "NtQueryKey" in "00000000-00000404.00000000.164306.E702F000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp"3a:T4a6,Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00008000.00000000.164636.8A8E0000.00000004.mdmp") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00008000.00000000.164636.8A980000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00008000.00000001.164745.8A900000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00008000.00000001.164745.8A900000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00008000.00000001.164745.8A920000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00008000.00000001.164745.8A920000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00008000.00000001.164745.8A9C0000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00008000.00000001.164745.8A9C0000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00008000.00000001.164745.8A9C0000.00000004.mdmp")3b:T662,"cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "reg.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")3c:T9c4,Process "reg.exe" (UID: 00000000-00000404) was launched with new environment variables: "beQyBdTRx="E", asXHcRbPxJBhi="i", lEGANVILZpqxDE="NCgQcYoIddFEtTNlYzZsOeGDkAbilwMOwndXlTMLLJAPocqXfQfFi", DpswKLvcDo="fXVFqlgJkiBKvi", VfJDJoLIIvNnSCdHC="R", xgFhBHYGtTcRmjP="MRYlgBdyjGJMKkaJihZoStjZusmN", IrDzdAbl="pnjDBozhABraCryNeadmvIWswQsWcBMpNm", QGvAMpidWrvw="w", dtLvRueXePxxGHQ="DnZSBdrOVujLfwhDsLkAU", UPSAWXZsrUNuvwG="PEUAGqnfhiTitAxLbpTFeV", UFRLWopO="M", oxAleOsNgylKxo="D", DxoZjT="CaCdlhUVrHtnxbhIWYpVGNaPjmNvcDt", HJouMYBoFBWNlM="U", IGrgoCb="Z", Mrrtcdl="nSlVcDvJnaqvmFFNNh", XORRP="yPPSdhsiLSiYBNmXhecSSGacuSbxGvhOX", hpfTSzgjveGVik="S", dHFPMvsYqY="GLWIXBzeMMBVtspOntMWndBGfnndED", nnhCC="L", HxQTZNHXuTkIpqUcdr="l", RKZSttsejeDYWmh="FwXzDSOZBJSFnzFDjxsZYAuZpEIpKTXnAGOXhBXqitrcxnvHEXrkohRYBSu", xnNayOUeqLiDrVeK="a", XdJiHZypZCqu="hGZjuvRodkzzzPrGAFdqEObJQSvToCfDkAweXYJhPfTAbcTdBhsN", TJsupczvMWggdZDz="y", EeWeFZ="G", fdVILfKGFXPNfl="tPnMroHaiUcKJuxcxANLpvFuYnQ", HQbwHNdPPbw="g", iAubiROLq="u", QUgsQfCBmqAdb="f", ngaIMxG="m", PrpuniTsgFuTihn="UguHvRRfYPhvetJZPIJIOZLBnraTjReNxfZ", miHUDEYDevzMGoTutQ="k", USERDNSDOMAIN="DESKTOP-FVVF82A", vrubNJqVx="zeKQNLDFLkuFPhPtqlOIqHwNItZSaYC", zCtpxysiDUiKPupbtN="PEHolfyRcycDMJYmAEvsnJmLJTvnDmOqHPRkKQvjP", pjBAFAuePqaFtvLb="BscsZZWWUPwIeabkfCklGGzFzyJjYi", twukPG="zaUAFRPzNhmtdkWEyUkljNXcpxFXzaPGLqCPOUnTFklHCK", bEeKPXMVtJ="T", ADCLDaG="sVcMKpQXgIWNgKvtXqtEOeGBWXcRENacmC", ATDRTrwhMDBDjE="SATQnVMLoQckYZWLHvbjQSnNimaHtqDVapasLJzxnhLIUPIlwuRtu", nYIiqzQQVkQJ="aMMyExtlLfDvMpyOkeHATkdmDNy", yweDgaqe="A", nvDRVavopcZbzVpZHw="K", EXARAFCeq="r", MybKXPsMl="LbybccqFrmhphepXwkJcFuDjKSvxWBBVobmXdHISNxE", IrZbPzSbRpWozaitTN="C", xLEFavtw="uwnhYcSSZur", HaYHMa="kEdjByLGOSkhxivIsRFkMoOsGTMFSYIvsmAvindoFTAh", dCbVzCxmYzSTE="s", IytRvD="n", ZAUpqaLxwgCysxV="P", xOVlwnj="d", dczUsrGHYSoDg="H", KMZWXxdQJvvrRPyVII="x", ZDeKsvBTs="jsxOcAtmTOlmwCTWwdQWizUyZkCulLoHkdOju", EBFcCIwBIeNxNrT="I", DehWjbRNfLibEu="p", PlFKLyi="h", cxVkbSRdoQFkAj="fwGDRMwlfiXctXCklmCDTZXwGcyaaTOGCvvIjFjVUDRZfnHtATmTWDJeB", bLMwiyzxSGVf="mFHpdWvFQBuWkjVbNKcLDtedoYxh", AfGYcYh="v", oFSOWLtKkAiyIyiZcQ="KLNdDvTNammkwEfXxD", BXZRxG="TKxjUxNzKysHZrwHscWEUYakrQWltyxvYXvfSacgZpFXvViubo"" Process "reg.exe" (UID: 00000000-00000404) was launched with modified environment variables: "ProgramFiles, NUMBER_OF_PROCESSORS, PROCESSOR_ARCHITECTURE, CommonProgramFiles" Process "reg.exe" (UID: 00000000-00000404) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432"3d:T71d,"cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "")3e:T74e,"powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00008000-00000C17-1538360655 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00008000-00000C17-1539005125 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00008000-00000C17-1539069412 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00008000-00000C17-1539460400 "powershell.exe" queries volume information of "C:\" at 00000000-00008000-00000C17-1539761592 "powershell.exe" queries volume information of "C:\share" at 00000000-00008000-00000C17-1539763112 "powershell.exe" queries volume information of "C:\share" at 00000000-00008000-00000C17-1539851963 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00008000-00000C17-1540767661 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00008000-00000C17-1541010708 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00008000-00000C17-15410573913f:Tc49,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135]40:T174f,Found string "system.security.cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00008000.00000000.164636.8A8E0000.00000004.mdmp, 00000000-00008000.00000001.164745.8A8C0000.00000004.mdmp, 00000000-00008000.00000001.164745.8A900000.00000004.mdmp, 00000000-00008000.00000001.164745.8A920000.00000004.mdmp, 00000000-00008000.00000001.164745.8A940000.00000004.mdmp") Found string "frombase64transform" (Indicator: "base64"; Source: "00000000-00008000.00000000.164636.8A8E0000.00000004.mdmp") Found string "frombase64transformmode" (Indicator: "base64"; Source: "00000000-00008000.00000000.164636.8A8E0000.00000004.mdmp") Found string "rijndaelmanagedtransform" (Indicator: "rijndael"; Source: "00000000-00008000.00000000.164636.8A8E0000.00000004.mdmp") Found string "rijndaelmanagedtransform" (Indicator: "Rijndaelmanaged"; Source: "00000000-00008000.00000000.164636.8A8E0000.00000004.mdmp") Found string "rsacryptoserviceprovider" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00008000.00000000.164636.8A8E0000.00000004.mdmp") Found string "system.security.cryptography.x509certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00008000.00000000.164636.8A8E0000.00000004.mdmp, 00000000-00008000.00000001.164745.8A8C0000.00000004.mdmp, 00000000-00008000.00000001.164745.8A900000.00000004.mdmp, 00000000-00008000.00000001.164745.8A920000.00000004.mdmp, 00000000-00008000.00000001.164745.8A940000.00000004.mdmp") Found string "cryptostream" (Indicator: "cryptostream"; Source: "00000000-00008000.00000000.164636.8A8E0000.00000004.mdmp") Found string "rijndaelmanaged" (Indicator: "rijndael"; Source: "00000000-00008000.00000000.164636.8A8E0000.00000004.mdmp") Found string "rijndaelmanaged" (Indicator: "Rijndaelmanaged"; Source: "00000000-00008000.00000000.164636.8A8E0000.00000004.mdmp") Found string "base64formattingoptions" (Indicator: "base64"; Source: "00000000-00008000.00000000.164636.8A8E0000.00000004.mdmp") Found string "tripledescryptoserviceprovider" (Indicator: "tripledescryptoserviceprovider"; Source: "00000000-00008000.00000000.164636.8A8E0000.00000004.mdmp") Found string "cryptostreammode" (Indicator: "cryptostream"; Source: "00000000-00008000.00000000.164636.8A8E0000.00000004.mdmp") Found string "cryptostreammode" (Indicator: "cryptostreammode"; Source: "00000000-00008000.00000000.164636.8A8E0000.00000004.mdmp") Found string "rijndael" (Indicator: "rijndael"; Source: "00000000-00008000.00000000.164636.8A8E0000.00000004.mdmp") Found string "psrsacryptoserviceprovider" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00008000.00000000.164636.8A960000.00000004.mdmp") Found string "base64decoder" (Indicator: "base64"; Source: "00000000-00008000.00000000.164636.8A9E0000.00000004.mdmp, 00000000-00008000.00000001.164745.8A9E0000.00000004.mdmp") Found string "sqlaes256cbcalgorithm" (Indicator: "aes"; Source: "00000000-00008000.00000000.164636.8A9E0000.00000004.mdmp, 00000000-00008000.00000001.164745.8A9E0000.00000004.mdmp") Found string "sqlaes256cbcalgorithm" (Indicator: "aes256"; Source: "00000000-00008000.00000000.164636.8A9E0000.00000004.mdmp, 00000000-00008000.00000001.164745.8A9E0000.00000004.mdmp") Found string "sqlaes256cbcfactory" (Indicator: "aes"; Source: "00000000-00008000.00000000.164636.8A9E0000.00000004.mdmp, 00000000-00008000.00000001.164745.8A9E0000.00000004.mdmp") Found string "sqlaes256cbcfactory" (Indicator: "aes256"; Source: "00000000-00008000.00000000.164636.8A9E0000.00000004.mdmp, 00000000-00008000.00000001.164745.8A9E0000.00000004.mdmp") Found string "sqlaeadaes256cbchmac256encryptionkey" (Indicator: "aes"; Source: "00000000-00008000.00000000.164636.8A9E0000.00000004.mdmp, 00000000-00008000.00000001.164745.8A9E0000.00000004.mdmp") Found string "sqlaeadaes256cbchmac256encryptionkey" (Indicator: "aes256"; Source: "00000000-00008000.00000000.164636.8A9E0000.00000004.mdmp, 00000000-00008000.00000001.164745.8A9E0000.00000004.mdmp") Found string "sqlaeadaes256cbchmac256algorithm" (Indicator: "aes"; Source: "00000000-00008000.00000000.164636.8A9E0000.00000004.mdmp, 00000000-00008000.00000001.164745.8A9E0000.00000004.mdmp") Found string "sqlaeadaes256cbchmac256algorithm" (Indicator: "aes256"; Source: "00000000-00008000.00000000.164636.8A9E0000.00000004.mdmp, 00000000-00008000.00000001.164745.8A9E0000.00000004.mdmp") Found string "sqlaeadaes256cbchmac256factory" (Indicator: "aes"; Source: "00000000-00008000.00000000.164636.8A9E0000.00000004.mdmp, 00000000-00008000.00000001.164745.8A9E0000.00000004.mdmp") Found string "sqlaeadaes256cbchmac256factory" (Indicator: "aes256"; Source: "00000000-00008000.00000000.164636.8A9E0000.00000004.mdmp, 00000000-00008000.00000001.164745.8A9E0000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp, 00000000-00008000.00000001.164745.9EDC0000.00000004.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp, 00000000-00008000.00000001.164745.9EE94000.00000004.mdmp") Found string "OFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp, 00000000-00008000.00000001.164745.9EDC0000.00000004.mdmp, 00000000-00008000.00000001.164745.9EE94000.00000004.mdmp") Found string "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp")18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"activity":{"behavior_tags":null,"file_activity":{"dropped_files":[],"extracted_files":[{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"verdict":"undetected"}],"files_deleted":[],"files_written":[{"path":"C:\\Users\\%OSUSER%","sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"path":"\\Global??\\FltMgrMsg","sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_q4iff1a4.zrk.ps1","sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_caylytum.c5j.psm1","sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8000:304:WilStaging_02","sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"name":"Local\\SM0:8000:304:WilStaging_02","sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"name":"SM0:8000:120:WilError_01","sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"name":"SM0:8000:304:WilStaging_02","sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8000:304:WilStaging_02","sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8000:120:WilError_01","sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]}]},"network_activity":{"contacted_hosts":[],"dns_resolutions":[],"http_requests":[]},"process_activity":{"all_imported_dlls":["combase.dll","ucrtbase_clr0400.dll","System.DirectoryServices.ni.dll","Microsoft.Management.Infrastructure.ni.dll","atl.dll","taskschd.dll","imm32.dll","version.dll","kernel32.dll","System.Management.Automation.ni.dll","vcruntime140_clr0400.dll","rsaenh.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","System.Configuration.Install.ni.dll","slc.dll","rpcrt4.dll","mscoree.dll","gpapi.dll","cryptbase.dll","SHCore.dll","fltLib.dll","bcryptprimitives.dll","clr.dll","msasn1.dll","shell32.dll","bcrypt.dll","shlwapi.dll","System.Core.ni.dll","System.Configuration.ni.dll","amsi.dll","msvcp_win.dll","System.Management.ni.dll","KernelBase.dll","clrjit.dll","System.Data.dll","secur32.dll","user32.dll","windows.storage.dll","VxSSL64.dll","ntdll.dll","Microsoft.PowerShell.Security.ni.dll","wintrust.dll","crypt32.dll","ws2_32.dll","cryptsp.dll","win32u.dll","powrprof.dll","profapi.dll","gdi32.dll","clbcatq.dll","System.Numerics.ni.dll","sechost.dll","msvcrt.dll","xmllite.dll","sppc.dll","System.ni.dll","advapi32.dll","ole32.dll","sspicli.dll","System.Transactions.ni.dll","mscoreei.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","ucrtbase.dll","userenv.dll","System.Data.ni.dll","cmdext.dll","MpOAV.dll","mscorlib.ni.dll","0EGfk1X9.dll","gdi32full.dll","uxtheme.dll","kernel.appcore.dll","System.Xml.ni.dll","MpClient.dll","System.Transactions.dll","cfgmgr32.dll","psapi.dll","wldp.dll","oleaut32.dll"],"processes":[{"command_line":"/c \"\"C:\\2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b.bin.bat\" \"","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACWklEQVR4Xu2U208aQRSH/ef70KQvfWgbpQoYxaCNtSByWy7bEqiwVloVZFFAhXjvA3d4OZ3fKBuyDGYWo33ZSU6YwML3zTm/YW7OXvZ6XG/evqPXLDP/xQS+p9LCVzOfCwyHwxerwWBglGWBau2MAmGFWu023d3/pU1/gI718sRz02oc3u/3rQkAvuBepZ14iku4PV4KqWn64HBNPCsqM9yyAMrp2aDC2RUF4j8oltHoz+kFLa56DUHz80/Be72enABa/PGzm8N9kSQVz6/oqHZJh9UGHVTq9DWo0OKKl+ZdK0KJaXBpAcw5ltaoVL+l44sbJpHg7UdthWK8C79PzskXTfLRyMKlBRA2wNRcng4rDb4ffYY9uuBXVCOcsvButysngB/FjyNwaLtIQEnn+B6ysnBpAcDDaobKjTvSG7e81aMRfAvHH7JwWqdgMk2bvoA0XFoAwXIse8i19oX8UZVl4YZl4ZqHscDCuMUklthNwHUslnQO3tV+UTShPgnvdDpyAiMJvLrWNkhnYVSzedpJpNiVvKQlz7rR9kA4SgvOZf6ckxX226GIEG5JYFS4jrHHeWM0kMCfU6Va4wIAZvJFyus12i9VKbV3QPPsPRF8JgH8J+BaImwP4YwacIW1HCcH/P0nBy+tcMLGs04/s9oEvM2+b1nAXOOB283t8bbj5COB3FGZ5yMST07Any0gSjtGgLbj5IAns/t8BCL4swREcAQNgQMQbcfJsfcHI0J4q9WaTWAafPyqQSTD5j7t5IDPJCADF6VdBG82m9MFXrPMfHvZy17/bf0DbjT7Mj+JPksAAAAASUVORK5CYII=","name":"cmd.exe","normalized_path":"%WINDIR%\\system32\\cmd.exe","pid":7820,"ppid":0,"sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","uid":"00000000-00007820"},{"command_line":"ADD HKCU\\Environment /v UserInitMprLogonScript /t REG_SZ /d \"%ALLUSERSPROFILE%\\Essay\\spcache.exe\" /f","name":"reg.exe","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00007820","pid":404,"ppid":7820,"sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","uid":"00000000-00000404"},{"command_line":"-command \"$time=(Get-Date).AddMinutes(8).ToString('HH:mm'); schtasks /create /sc once /st $time /tn 'cream' /tr '%ALLUSERSPROFILE%\\Essay\\spcache.exe' /f\"","name":"powershell.exe","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00007820","pid":8000,"ppid":7820,"sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","uid":"00000000-00008000"},{"command_line":"/create /sc once /st 11:48 /tn cream /tr %ALLUSERSPROFILE%\\Essay\\spcache.exe /f","name":"schtasks.exe","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00008000","pid":7964,"ppid":8000,"sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","uid":"00000000-00007964"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\ENVIRONMENT\\","sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]}],"keys_deleted":[],"keys_modified":[]},"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"analysis_start_time":"2026-03-06T11:39:50+00:00","environment_description":"Windows 10 64 bit","environment_id":160,"id":"69aabd051413fd04630e5211","indicators_count":{"informative":149,"malicious":4,"suspicious":21},"is_in_unified_schema":true,"state":"SUCCESS","submit_name":"2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b.bin","tags":["Multi-Process","Extracted Files"],"threat_score":85,"verdict":"malicious"}],"stats":{"contacted_hosts_count":0,"contacted_urls_count":0,"dns_resolutions_count":0,"dropped_files_count":0,"embedded_domains_count":0,"embedded_ips_count":0,"embedded_urls_count":0,"extracted_files_count":1,"files_deleted_count":0,"files_written_count":8,"http_requests_count":0,"imported_dlls_count":79,"injected_processes_count":0,"mutex_created_count":6,"process_count":4,"registry_keys_created_count":1,"registry_keys_deleted_count":0,"registry_keys_modified_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"script_calls_count":0,"spawned_processes_count":4}},"all_analysis_status":{"fastscan_status":"SUCCESS","qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS"},"detections":{"attributions":{},"av_detections":{"engines":{"ahnlab":{"data_source":"MetaDefender","name":"AhnLab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"antiy":{"data_source":"MetaDefender","name":"Antiy","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"aurora":{"data_source":"MetaDefender","name":"Aurora","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"avira":{"data_source":"MetaDefender","name":"Avira","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"bitdefender":{"data_source":"MetaDefender","name":"Bitdefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"clamav":{"data_source":"MetaDefender","name":"ClamAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"cmc":{"data_source":"MetaDefender","name":"CMC","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"emsisoft":{"data_source":"MetaDefender","name":"Emsisoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"eset":{"data_source":"MetaDefender","name":"ESET","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"filseclab":{"data_source":"MetaDefender","name":"Filseclab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"gridinsoft":{"data_source":"MetaDefender","name":"Gridinsoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"huorong":{"data_source":"MetaDefender","name":"Huorong","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"k7":{"data_source":"MetaDefender","name":"K7","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"lionic":{"data_source":"MetaDefender","name":"Lionic","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"nanoav":{"data_source":"MetaDefender","name":"NANOAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"netgate":{"data_source":"MetaDefender","name":"NETGATE","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"rocketcyber":{"data_source":"MetaDefender","name":"RocketCyber","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"sophos":{"data_source":"MetaDefender","name":"Sophos","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"tachyon":{"data_source":"MetaDefender","name":"TACHYON","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"trellix":{"data_source":"MetaDefender","name":"Trellix","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"varist":{"data_source":"MetaDefender","name":"Varist","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"viritexplorer":{"data_source":"MetaDefender","name":"Vir.IT eXplorer","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"virusblokada":{"data_source":"MetaDefender","name":"VirusBlokAda","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"webrootsmd":{"data_source":"MetaDefender","name":"Webroot SMD","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"xcitium":{"data_source":"MetaDefender","name":"Xcitium","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"zillya":{"data_source":"MetaDefender","name":"Zillya!","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"}}},"incidents":[{"details":[{"detail":"Marks file for deletion"}],"details_count":1,"name":"Evasive","sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Tries to use windows logon scripts to establish persistence"}],"details_count":4,"name":"Persistence","sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]}],"mitre_attacks":[{"attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft"},{"attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Service Discovery"},{"attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Process Injection"},{"attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Software Packing"},{"attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Credentials from Password Stores"},{"attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Execution","technique":"Inter-Process Communication"},{"attack_id":"T1574.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/007","sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Persistence","technique":"Path Interception by PATH Environment Variable"},{"attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"System Checks"},{"attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Collection","technique":"Data from Local System"},{"attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Impact","technique":"Data Encrypted for Impact"},{"attack_id":"T1037.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1037/003","identifiers":[{"type":"informative","value":"Able to establish enduring access through network startup procedures"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Persistence","technique":"Network Logon Script"},{"attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File Deletion"},{"attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Executes batch file"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Execution","technique":"Command and Scripting Interpreter"},{"attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Persistence","technique":"Modify Registry"},{"attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Access Token Manipulation"},{"attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Retrieves specified items using PowerShell"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Attempts to get system information using PowerShell"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Information Discovery"},{"attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Collection","technique":"Email Collection"},{"attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"malicious","value":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Execution","technique":"Scheduled Task"},{"attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Execution","technique":"Component Object Model"},{"attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Credential Access","technique":"OS Credential Dumping"},{"attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets"},{"attack_id":"T1037.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1037/001","identifiers":[{"type":"malicious","value":"Tries to use windows logon scripts to establish persistence"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Persistence","technique":"Logon Script (Windows)"},{"attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Reflective Code Loading"},{"attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Discovery","technique":"Process Discovery"},{"attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information"},{"attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Disable or Modify Tools"},{"attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Language Discovery"},{"attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Ingress Tool Transfer"},{"attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Lateral Movement","technique":"Lateral Tool Transfer"},{"attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Application Layer Protocol"},{"attack_id":"T1546.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/013","identifiers":[{"type":"informative","value":"Contains reference to Powershell profile file"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Persistence","technique":"PowerShell Profile"},{"attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection"},{"attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Able to identify sandbox environment running process"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion"},{"attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information"},{"attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access Powershell profile file"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Discovery","technique":"File and Directory Discovery"},{"attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"suspicious","value":"Opens a handle to the specified local process"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Impact","technique":"Service Stop"},{"attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Execution","technique":"Service Execution"},{"attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Persistence","technique":"Component Object Model Hijacking"},{"attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation"},{"attack_id":"T1014","attack_id_wiki":"https://attack.mitre.org/techniques/T1014","identifiers":[{"type":"informative","value":"References device drivers used by rootkit malware"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Rootkit"},{"attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Owner/User Discovery"},{"attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Asymmetric Cryptography"},{"attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Exfiltration","technique":"Scheduled Transfer"},{"attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"ListPlanting"},{"attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism"},{"attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Masquerading"},{"attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Discovery","technique":"Query Registry"},{"attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Encrypted Channel"},{"attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Executes powershell with commandline"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Execution","technique":"PowerShell"},{"attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Execution Guardrails"},{"attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Discovery","technique":"Application Window Discovery"},{"attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Execution","technique":"Shared Modules"},{"attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Timestomp"},{"attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Persistence","technique":"Windows Service"},{"attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking"},{"attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Time Based Evasion"},{"attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Location Discovery"},{"attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Discovery","technique":"Remote System Discovery"},{"attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Time Discovery"},{"attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Proxy"},{"attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Data Encoding"},{"attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Persistence","technique":"Boot or Logon Autostart Execution"},{"attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"}],"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}],"tactic":"Execution","technique":"Native API"}],"rule_matches":{},"sandbox_signatures":[{"category":"Spyware/Information Retrieval","description":"Process \"powershell.exe\" with commandline \"-command \"$time=(Get-Date).AddMinutes(8).ToString('HH:mm'); schtasks /create /sc once /st $time /tn 'cream' /tr '%ALLUSERSPROFILE%\\\\Essay\\\\spcache.exe' /f\"\" (UID: 00000000-00008000)","id":"target-477","level":"informative","mitre_attack_id":"T1082","name":"Retrieves specified items using PowerShell","origin":"Monitored Target","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"System Security","description":"\"cmd.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\WINDOWSPOWERSHELL\\V1.0\\POWERSHELL.EXE\"; Value: \"+t�\")","id":"registry-67","level":"informative","mitre_attack_id":"T1543.003","name":"Creates or modifies windows services","origin":"Registry Access","relevance":10,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$22","id":"api-125","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get system version information","origin":"API Call","relevance":3,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008000)","id":"api-222","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve OS information","origin":"API Call","relevance":2,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00008000)","id":"api-141","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve computer name","origin":"API Call","relevance":2,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")","id":"registry-18","level":"informative","mitre_attack_id":"T1012","name":"Accesses Software Policy Settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"General","description":"$23","id":"api-176","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to retrieve function addresses","origin":"API Call","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"General","description":"Process powershell.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8000:304:WilStaging_02\"\n Process powershell.exe created mutex with name \"Local\\SM0:8000:304:WilStaging_02\"\n Process powershell.exe created mutex with name \"SM0:8000:120:WilError_01\"\n Process powershell.exe created mutex with name \"SM0:8000:304:WilStaging_02\"\n Process powershell.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:8000:304:WilStaging_02\"\n Process powershell.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:8000:120:WilError_01\"","id":"mutant-0","level":"informative","mitre_attack_id":"T1480","name":"Creates mutants","origin":"Created Mutant","relevance":3,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp\")","id":"string-164","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve the fully qualified path of module (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"System Security","description":"$24","id":"registry-173","level":"informative","mitre_attack_id":"T1007","name":"Queries services related registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"System Security","description":"\"powershell.exe\" opens a process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 00000000-00008000)","id":"api-284","level":"suspicious","mitre_attack_id":"T1489","name":"Opens a handle to the specified local process","origin":"API Call","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\System32\\taskschd.dll\" at 119E0000","id":"module-4","level":"malicious","mitre_attack_id":"T1559.001","name":"Loads the task scheduler COM API","origin":"Loaded Module","relevance":5,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00008000.00000000.164636.96CC0000.00000004.mdmp, 00000000-00008000.00000001.164745.96CC0000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00008000.00000000.164636.96CC0000.00000004.mdmp, 00000000-00008000.00000001.164745.96CC0000.00000004.mdmp\")","id":"string-666","level":"informative","mitre_attack_id":"T1497","name":"Able to identify sandbox environment running process","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Able to import cryptographic keys (seen in ransomware)\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm\n Matched sigs: Able to decrypt/decode data\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Calls an API typically used to import cryptographic keys into a CSP\n Matched sigs: Reads the cryptographic machine GUID","id":"summary-28","level":"informative","mitre_attack_id":"T1027","name":"Shows ability to obfuscate file or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"REGEDIT: CreateFile failed, GetLastError() = %d\" (Indicator: \"GetLastError\"; Source: \"00000000-00000404.00000000.164306.E702F000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00000404.00000000.164306.E702F000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00000404.00000000.164306.E702F000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp\")","id":"string-319","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to set/get the last-error code for a calling thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"General","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"reg.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"reg.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","id":"registry-25","level":"informative","mitre_attack_id":"T1082","name":"Reads information about supported languages","origin":"Registry Access","relevance":3,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"cmd.exe\" queries basic process information of the \"C:\\Windows\\System32\\cmd.exe\" (UID: 7820)","id":"api-235","level":"informative","mitre_attack_id":"T1057","name":"Queries basic information of the specified process","origin":"API Call","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$25","id":"string-85","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to enumerate process and/or its information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00008000)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00008000)","id":"api-110","level":"suspicious","mitre_attack_id":"T1082","name":"Calls an API typically used to find and list the Windows drive types","origin":"API Call","relevance":10,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00008000-00000C2C-1537852012\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00008000-00000C2C-1537852041\")","id":"string-721","level":"informative","mitre_attack_id":"T1055.015","name":"Able to visualize and control listed components (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"General","description":"$26","id":"string-101","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to execute Windows APIs","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000404.00000000.164306.E702F000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00000404.00000000.164306.E702F000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00008000.00000000.164636.01B42000.00000002.mdmp\")","id":"string-272","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to retrieve/open a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"General","description":"$27","id":"api-7","level":"informative","mitre_attack_id":"T1129","name":"Loads modules at runtime","origin":"API Call","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at E9D20000","id":"module-7","level":"informative","mitre_attack_id":"T1620","name":"Loads the CLR Loader DLL","origin":"Loaded Module","sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"General","description":"Spawned process \"reg.exe\" with commandline \"ADD HKCU\\\\Environment /v UserInitMprLogonScript /t REG_SZ /d \"%A ...\" (UID: 00000000-00000404), Spawned process \"powershell.exe\" with commandline \"-command \"$time=(Get-Date).AddMinutes(8).ToString('HH:mm'); scht ...\" (UID: 00000000-00008000)\n Spawned process \"schtasks.exe\" with commandline \"/create /sc once /st 11:48 /tn cream /tr %ALLUSERSPROFILE%\\\\Essa ...\" (UID: 00000000-00007964)","id":"target-25","level":"informative","mitre_attack_id":"T1057","name":"Spawns new processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00000404.00000000.164306.E702F000.00000002.mdmp\")\n Found reference to API \"RegRestoreKeyW\" (Indicator: \"RegRestoreKey\"; Source: \"00000000-00000404.00000000.164306.E702F000.00000002.mdmp\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00000404.00000000.164306.E702F000.00000002.mdmp\")\n Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; Source: \"00000000-00000404.00000000.164306.E702F000.00000002.mdmp\")\n Found reference to API \"RegSetValueW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00000404.00000000.164306.E702F000.00000002.mdmp\")","id":"string-304","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to modify registry key/value (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000404.00000000.164306.E702F000.00000002.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00008000.00000000.164636.01B42000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp\")","id":"string-247","level":"informative","mitre_attack_id":"T1124","name":"Contains ability to retrieve machine time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\__psscriptpolicytest_q4iff1a4.zrk.ps1\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\__psscriptpolicytest_caylytum.c5j.psm1\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\windows\\powershell\\startupprofiledata-noninteractive\"\n \"powershell.exe\" writes file \"%temp%\\__psscriptpolicytest_q4iff1a4.zrk.ps1\"\n \"powershell.exe\" writes file \"%temp%\\__psscriptpolicytest_caylytum.c5j.psm1\"\n \"powershell.exe\" writes file \"%localappdata%\\microsoft\\windows\\powershell\\startupprofiledata-noninteractive\"","id":"api-242","level":"informative","name":"Writes files","origin":"API Call","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"11442171428,6704,3147,,GetComputerNameW,kernel32.dll,\"00:42:52.328\",RX=0,PX=0\" (Indicator: \"GetComputerName\"; Source: \"00000000-00008000.00000000.164636.84980000.00000004.mdmp\")\n Found reference to API \"15098303976,6704,3147,,GetComputerNameW,kernel32.dll,\"00:42:53.859\",RX=0,PX=0\" (Indicator: \"GetComputerName\"; Source: \"00000000-00008000.00000001.164745.9F43E000.00000004.mdmp\")","id":"string-122","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"System Security","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00008000-00000C2C-1535743201\")\n Found string \"OpenProcessTokenW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00008000-00000C2C-1537303722\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00008000-00000C2C-1537304155\")\n Found string \"OpenProcessW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00008000-00000C2C-1537304177\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000404.00000000.164306.E702F000.00000002.mdmp\")","id":"string-729","level":"informative","mitre_attack_id":"T1489","name":"Able to retrieve/open a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"reg.exe\" (Path: \"HKCU\\ENVIRONMENT\"; Key: \"USERINITMPRLOGONSCRIPT\"; Value: \"%ALLUSERSPROFILE%\\Essay\\spcache.exe\")","id":"registry-90","level":"malicious","mitre_attack_id":"T1037.001","name":"Tries to use windows logon scripts to establish persistence","origin":"Registry Access","relevance":7,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00008000)","id":"api-296","level":"informative","mitre_attack_id":"T1497","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","origin":"API Call","relevance":3,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00008000)","id":"api-152","level":"informative","mitre_attack_id":"T1010","name":"Calls an API typically used to enumerate active windows","origin":"API Call","relevance":3,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"General","description":"Process \"cmd.exe\" with commandline \"/c \"\"C:\\\\2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b.bin.bat\" \"\" (UID: 00000000-00007820)","id":"target-220","level":"informative","mitre_attack_id":"T1059","name":"Executes batch file","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","id":"api-108","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve information about the current system","origin":"API Call","relevance":3,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00008000]","id":"binary-37","level":"informative","mitre_attack_id":"T1036","name":"Drops files inside appdata directory","origin":"Binary File","relevance":3,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$28","id":"string-226","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00000404.00000000.164306.E702F000.00000002.mdmp\")\n Found reference to API \"RegUnLoadKeyW\" (Indicator: \"RegUnLoadKey\"; Source: \"00000000-00000404.00000000.164306.E702F000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp\")","id":"string-345","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to disable/close registry key (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"General","description":"Pattern match: \"premium-server@thawte.com\"","id":"string-63","level":"informative","mitre_attack_id":"T1114","name":"Found E-Mail address in binary/memory","origin":"File/Memory","relevance":3,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","id":"registry-20","level":"informative","mitre_attack_id":"T1012","name":"Reads Windows Trust Settings","origin":"Registry Access","relevance":5,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$29","id":"api-102","level":"informative","mitre_attack_id":"T1083","name":"Calls an API typically used for searching a directory for files","origin":"API Call","relevance":5,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 8000)","id":"api-1","level":"suspicious","mitre_attack_id":"T1562.001","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","origin":"API Call","relevance":10,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00008000.00000000.164636.8A8E0000.00000004.mdmp\")\n Found string \"psrsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00008000.00000000.164636.8A960000.00000004.mdmp\")","id":"string-352","level":"informative","mitre_attack_id":"T1573.002","name":"Contains ability to perform encryption/decryption using RSA algorithm","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp\")","id":"string-201","level":"informative","mitre_attack_id":"T1614","name":"Able to query system locale information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00008000.00000000.164636.01B42000.00000002.mdmp\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp\"","id":"string-89","level":"informative","mitre_attack_id":"T1082","name":"Able to retrieve information about the current system (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134172996232905983.8000.DefaultAppDomain.powershell\" - (UID: 00000000-00008000)","id":"api-138","level":"informative","mitre_attack_id":"T1570","name":"Calls an API typically used to create an instance of a named pipe","origin":"API Call","relevance":3,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"System Security","description":"Found string \"\\Device\\HarddiskVolume2\\DosDevices\\C:\\??\\Volume{815ead30-0000-0000-0000-501f00000000}\" (Indicator: \"\\DosDevices\\c:\"; Source: \"00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp\")","id":"string-458","level":"informative","mitre_attack_id":"T1014","name":"References device drivers used by rootkit malware","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00008000)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00008000)","id":"api-148","level":"informative","mitre_attack_id":"T1033","name":"Calls an API typically used to retrieve account information for specified SID","origin":"API Call","relevance":3,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","id":"registry-1","level":"informative","mitre_attack_id":"T1082","name":"Reads the cryptographic machine GUID","origin":"Registry Access","relevance":5,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 02D30000","id":"module-8","level":"informative","mitre_attack_id":"T1562.001","name":"Loads the AMSI (Antimalware Scan Interface) DLL","origin":"Loaded Module","sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"System Destruction","description":"\"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_q4iff1a4.zrk.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_caylytum.c5j.psm1\" for deletion","id":"api-26","level":"suspicious","mitre_attack_id":"T1070.004","name":"Marks file for deletion","origin":"API Call","relevance":10,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00008000.00000000.164636.01B42000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00008000.00000000.164636.01B42000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00008000.00000000.164636.01B42000.00000002.mdmp\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp\")","id":"string-550","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to find and load resources of specific modules (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify sandbox environment running process\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","id":"summary-29","level":"informative","mitre_attack_id":"T1480","name":"Shows ability to use execution guardrails","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"System Security","description":"\"cmd.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\WINDOWSPOWERSHELL\\V1.0\\POWERSHELL.EXE\"; Value: \"+t�\")\n \"reg.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\ENVIRONMENT\"; Key: \"USERINITMPRLOGONSCRIPT\"; Value: \"%ALLUSERSPROFILE%\\Essay\\spcache.exe\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2F3\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")","id":"registry-136","level":"informative","mitre_attack_id":"T1112","name":"Writes registry keys","origin":"Registry Access","relevance":3,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"Found string \"reg.exe ADD HKCU\\Environment /v UserInitMprLogonScript /t REG_SZ /d \"%ALLUSERSPROFILE%\\Essay\\spcache.exe\" /f\" (Indicator: \"userinitmprlogonscript\"; Source: \"00000000-00007820-00000C47-2093665838\")\n Found string \"UserInitMprLogonScript\" (Indicator: \"userinitmprlogonscript\"; Source: \"00000000-00000404-00000BC0-1530509295\")\n Found string \"ADD HKCU\\Environment /v UserInitMprLogonScript /t REG_SZ /d \"%ALLUSERSPROFILE%\\Essay\\spcache.exe\" /f\" (Indicator: \"userinitmprlogonscript\"; File: \"reg.exe\")\n Found string \"reg.exe ADD HKCU\\Environment /v UserInitMprLogonScript /t REG_SZ /d \"C:\\ProgramData\\Essay\\spcache.exe\" /f\" (Indicator: \"userinitmprlogonscript\"; Source: \"00000000-00000404.00000000.164306.96AC0000.00000004.mdmp\")\n Found string \"UserInitMprLogonScript\" (Indicator: \"userinitmprlogonscript\"; Source: \"00000000-00000404.00000000.164306.96AC0000.00000004.mdmp, 00000000-00000404.00000000.164306.96DD0000.00000004.mdmp\")","id":"string-716","level":"informative","mitre_attack_id":"T1037.003","name":"Able to establish enduring access through network startup procedures","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"Process \"schtasks.exe\" with commandline \"/create /sc once /st 11:48 /tn cream /tr %ALLUSERSPROFILE%\\\\Essay\\\\spcache.exe /f\" (UID: 00000000-00007964)","id":"target-13","level":"malicious","mitre_attack_id":"T1053.005","name":"Schedules a task to be executed at a specific time and date","origin":"Monitored Target","relevance":8,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"powershell.exe\" wrote 00000FB8 bytes to a remote process \"C:\\Windows\\System32\\schtasks.exe\" (Handle: 2040)\n \"powershell.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\System32\\schtasks.exe\" (Handle: 2040)","id":"api-0","level":"malicious","mitre_attack_id":"T1055","name":"Writes data to a remote process","origin":"API Call","relevance":6,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00008000-00000C17-1539761592","id":"api-39","level":"informative","mitre_attack_id":"T1082","name":"Queries volume information of an entire harddrive","origin":"API Call","relevance":8,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" (Indicator: \" bind \"; Source: \"00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp, 00000000-00008000.00000001.164745.9EDC0000.00000004.mdmp\")\n Found reference to API \"ote: There is some performance penalty associated with assembly bind failure logging.\" (Indicator: \" bind \"; Source: \"00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp, 00000000-00008000.00000001.164745.9EDC0000.00000004.mdmp\")","id":"string-899","level":"informative","mitre_attack_id":"T1071","name":"Contains references to network communication API (string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","id":"registry-35","level":"informative","mitre_attack_id":"T1082","name":"Reads the active computer name","origin":"Registry Access","relevance":5,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\27748148BBE67A43CDBFEC6C3784862CE134E6EA\"; Key: \"BLOB\")","id":"registry-17","level":"informative","mitre_attack_id":"T1112","name":"Accesses System Certificates Settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"General","description":"$2a","id":"memorydump-10","level":"informative","mitre_attack_id":"T1012","name":"Found registry location strings in memory","origin":"Memory Dumps","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_q4iff1a4.zrk.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_caylytum.c5j.psm1\"","id":"api-267","level":"informative","mitre_attack_id":"T1005","name":"Writes files in a temp directory","origin":"API Call","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"cmd.exe\" reads file \"c:\\2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b.bin.bat\"","id":"api-243","level":"informative","mitre_attack_id":"T1083","name":"Reads files","origin":"API Call","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; Source: \"00000000-00000404.00000000.164306.E702F000.00000002.mdmp\")","id":"string-97","level":"informative","mitre_attack_id":"T1548","name":"Contains ability to use security policy setting (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp\")","id":"string-143","level":"informative","mitre_attack_id":"T1614.001","name":"Able to retrieve system language (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"General","description":"\"cmd.exe\" called \"CreateProcessW\" with parameter \"reg.exe ADD HKCU\\Environment /v UserInitMprLogonScript /t REG_SZ /d \"%ALLUSERSPROFILE%\\Essay\\spcache.exe\" /f\" - (UID: 00000000-00007820)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"powershell.exe -command \"$time=(Get-Date).AddMinutes(8).ToString('HH:mm'); schtasks /create /sc once /st $time /tn 'cream' /tr 'C\" - (UID: 00000000-00007820), \"powershell.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\system32\\schtasks.exe\" /create /sc once /st 11:48 /tn cream /tr %ALLUSERSPROFILE%\\Essay\\spcache.exe /f\" - (UID: 00000000-00008000)","id":"api-128","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to create a process","origin":"API Call","relevance":5,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"General","description":"$2b","id":"string-625","level":"informative","mitre_attack_id":"T1083","name":"References Windows file paths for DLLs (possible dropped files)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00000404.00000000.164306.E702F000.00000002.mdmp\")","id":"string-121","level":"informative","mitre_attack_id":"T1033","name":"Contains ability to retrieve usernames and/or user information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"System Security","description":"$2c","id":"string-474","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to access device drivers","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"MpFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00008000.00000000.164636.01B42000.00000002.mdmp\")","id":"string-92","level":"informative","mitre_attack_id":"T1055","name":"Able to inject code into another process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00000404.00000000.164306.E702F000.00000002.mdmp\")","id":"string-306","level":"informative","mitre_attack_id":"T1134.001","name":"Contains ability to impersonate access tokens (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"file/memory contains long string with (Indicator: \"Oid\"; File: \"2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b.bin\")\n Found reference to \"::qGCvFYuroKdbIyFCQeFBVIiUOuaHGtAEieRUrwQOisdMMxTSGUojrHrvUAmJZCOibpJhOrVdddOidtBAxhfcntzREIXhKpgiviiKUeJsFRjkhigzCqESNOdFGNkqOOsUTJwLabTfwpTL\" (Indicator: \"Oid\"; File: \"2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b.bin\")\n Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00008000-00000BC0-1536326214\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp, 00000000-00008000.00000001.164745.9EDC0000.00000004.mdmp\")","id":"string-138","level":"informative","mitre_attack_id":"T1027","name":"Contains ability to use Cryptographic classes","origin":"File/Memory","relevance":2,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$2d","id":"string-326","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve environment variable settings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00000404.00000000.164306.E702F000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp\")","id":"string-249","level":"informative","mitre_attack_id":"T1070.006","name":"Contains ability to retrieve file time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00000404.00000000.164306.E702F000.00000002.mdmp\")","id":"string-534","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to read files (API string)","origin":"File/Memory","sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00000404.00000000.164306.E702F000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp\")","id":"string-535","level":"informative","mitre_attack_id":"T1105","name":"Contains ability to write files (API string)","origin":"File/Memory","sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00008000.00000001.164745.8A900000.00000004.mdmp\")","id":"string-126","level":"informative","mitre_attack_id":"T1082","name":"Found system command-related strings","origin":"File/Memory","relevance":7,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00000404.00000000.164306.E702F000.00000002.mdmp\")","id":"string-308","level":"informative","mitre_attack_id":"T1070.004","name":"Contains ability to delete files/directories (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp\")","id":"string-602","level":"informative","mitre_attack_id":"T1573","name":"Able to use Microsoft's Enhanced Cryptographic Provider","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"cmd.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007820)","id":"api-297","level":"informative","mitre_attack_id":"T1003","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","origin":"API Call","relevance":3,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00008000.00000000.164636.01B42000.00000002.mdmp\")\n Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp\")\n Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp\")","id":"string-171","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the OS information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"General","description":"$2e","id":"api-175","level":"informative","mitre_attack_id":"T1129","name":"Calls an API typically used to load libraries","origin":"API Call","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"General","description":"Found string - \\\\.\\pipe\\PSHost.134172996232905983.8000.DefaultAppDomain.powershell","id":"string-146","level":"informative","mitre_attack_id":"T1559","name":"Found named pipe like strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Network Related","description":"$2f","id":"memorydump-2","level":"informative","mitre_attack_id":"T1071","name":"Found potential URLs in memory dumps","origin":"Memory Dumps","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00000404.00000000.164306.E702F000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00000404.00000000.164306.E702F000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp\")","id":"string-316","level":"informative","mitre_attack_id":"T1489","name":"Contains ability to terminate a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"System Security","description":"$30","id":"registry-19","level":"suspicious","mitre_attack_id":"T1112","name":"Modifies Software Policy Settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at E8720000","id":"module-3","level":"informative","mitre_attack_id":"T1129","name":"Loads the .NET runtime environment","origin":"Loaded Module","sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"General","description":"Observed system executable string:\"%WINDIR%\\System32\\reg.exe\" [Source: 00000000-00007820-00000BC0-1529791785]\n Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00007820-00000BC0-1534956270]\n Observed system executable string:\"%WINDIR%\\system32\\reg.exe\" [Source: 00000000-00007820-00000C47-2093665838]\n Observed system executable string:\"%WINDIR%\\System32\\schtasks.exe\" [Source: 00000000-00008000-00000BC0-1541176537]\n Observed system executable string:\"\"%WINDIR%\\system32\\schtasks.exe\" /create /sc once /st 11:48 /tn cream /tr %ALLUSERSPROFILE%\\Essay\\spcache.exe /f\" [Source: 00000000-00008000-00000C47-14614627150]","id":"string-170","level":"informative","name":"Possibly uses system binaries (Windows LOLbins)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$31","id":"registry-172","level":"informative","mitre_attack_id":"T1012","name":"Queries registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"reg.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","id":"api-103","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used for taking snapshot of the specified processes","origin":"API Call","relevance":3,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"REGEDIT: CreateFile failed, GetLastError() = %d\" (Indicator: \"CreateFile\"; Source: \"00000000-00000404.00000000.164306.E702F000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00000404.00000000.164306.E702F000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp\")","id":"string-315","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to create/open files (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"General","description":"\"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 17C00000\n \"reg.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 17C00000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 17C00000\n \"schtasks.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 17C00000","id":"module-10","level":"informative","mitre_attack_id":"T1129","name":"Loads the RPC (Remote Procedure Call) module DLL","origin":"Loaded Module","sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"General","description":"Spawned process \"reg.exe\" with commandline \"ADD HKCU\\\\Environment /v UserInitMprLogonScript /t REG_SZ /d \"%A ...\" (UID: 00000000-00000404), Spawned process \"powershell.exe\" with commandline \"-command \"$time=(Get-Date).AddMinutes(8).ToString('HH:mm'); scht ...\" (UID: 00000000-00008000)\n Spawned process \"schtasks.exe\" with commandline \"/create /sc once /st 11:48 /tn cream /tr %ALLUSERSPROFILE%\\\\Essa ...\" (UID: 00000000-00007964)","id":"target-103","level":"informative","mitre_attack_id":"T1057","name":"Spawns new processes that are not known child processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"\n \"powershell.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"","id":"api-55","level":"informative","mitre_attack_id":"T1083","name":"Touches files in the Windows directory","origin":"API Call","relevance":7,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Network Related","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00008000.00000001.164745.8A900000.00000004.mdmp\")","id":"string-417","level":"informative","mitre_attack_id":"T1018","name":"Able to identify remote systems","origin":"File/Memory","relevance":7,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"System Security","description":"\"powershell.exe\" opened \"\\Device\\KsecDD\"","id":"api-37","level":"informative","mitre_attack_id":"T1068","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","origin":"API Call","relevance":10,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00008000-00000C2C-1537141812\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00008000-00000C2C-1538398875\")","id":"string-659","level":"informative","mitre_attack_id":"T1497.001","name":"Able to identify virtual environment by using API string","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"System Destruction","description":"\"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_q4iff1a4.zrk.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_caylytum.c5j.psm1\" with delete access","id":"api-25","level":"suspicious","mitre_attack_id":"T1070.004","name":"Opens file with deletion access rights","origin":"API Call","relevance":7,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"External Systems","description":"0/26 Antivirus vendors marked sample as clean (0% detection rate)","id":"avtest-1","level":"informative","name":"Sample was identified as clean by Antivirus engines","origin":"External System","relevance":10,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$32","id":"api-126","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"cmd.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00007820)","id":"api-294","level":"informative","mitre_attack_id":"T1082","name":"Attempts to call APIs to gather system and hardware detail","origin":"API Call","relevance":3,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\cmd.exe\"\n \"cmd.exe\" trying to touch file \"C:\\windows\\temp\\VxOle64.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\system32\\IMM32.DLL\"\n \"cmd.exe\" trying to touch file \"\\Device\\CNG\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\oleaut32.dll\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\system32\\oleaut32.dll\"","id":"api-263","level":"informative","mitre_attack_id":"T1083","name":"Touches files","origin":"API Call","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$33","id":"string-207","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to retrieve file and directory information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"System Security","description":"Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00000404.00000000.164306.E702F000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00000404.00000000.164306.E702F000.00000002.mdmp\"","id":"string-230","level":"informative","mitre_attack_id":"T1112","name":"Able to delete registry key/value (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"SeBackupPrivilege\" (Indicator: \"SeBackupPrivilege\"; Source: \"00000000-00000404.00000000.164306.E702F000.00000002.mdmp\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00000404.00000000.164306.E702F000.00000002.mdmp\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"00000000-00000404.00000000.164306.E702F000.00000002.mdmp\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00008000.00000000.164636.84980000.00000004.mdmp, 00000000-00008000.00000001.164745.84980000.00000004.mdmp\")","id":"string-77","level":"informative","mitre_attack_id":"T1134","name":"Contains ability to modify access token privileges (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00008000-00000C2C-1537141812\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00008000-00000C2C-1538398875\")","id":"string-907","level":"informative","mitre_attack_id":"T1057","name":"Able to enumerate system processes using native API","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp\")","id":"string-318","level":"informative","mitre_attack_id":"T1055.001","name":"Contains ability to load/free library (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"General","description":"\"2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b.bin\" was detected as \"plain text\" and name: \"Format\"","id":"static-157","level":"informative","mitre_attack_id":"T1027","name":"Matched Compiler/Packer signature (DIE)","origin":"Static Parser","sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","id":"api-264","level":"informative","mitre_attack_id":"T1055.003","name":"Creates a thread in a self process","origin":"API Call","relevance":3,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00008000.00000000.164636.01B42000.00000002.mdmp\")","id":"string-86","level":"informative","mitre_attack_id":"T1082","name":"Able to discover operating system information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$34","id":"api-9","level":"informative","mitre_attack_id":"T1057","name":"Queries process information","origin":"API Call","relevance":4,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" called \"IsWow64Process\" with parameter \"8000\" - (UID: 00000000-00008000)","id":"api-146","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used to determine if process is running under WOW64","origin":"API Call","relevance":3,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp\")","id":"string-317","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve address of exported function from a DLL (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00008000)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00008000)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00008000)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00008000)","id":"api-140","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to find a resource in a module","origin":"API Call","relevance":3,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \":\\Users\\HAPUBWS\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1\" (Indicator: \"\\windowspowershell\\microsoft.powershell_profile.ps1\"; Source: \"00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp\")\n Found string \"??\\C:\\Users\\HAPUBWS\\Documents\\WindowsPowerShell\\profile.ps1\" (Indicator: \"\\windowspowershell\\profile.ps1\"; Source: \"00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp\")","id":"string-448","level":"informative","mitre_attack_id":"T1546.013","name":"Contains reference to Powershell profile file","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"General","description":"Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00000404.00000000.164306.E702F000.00000002.mdmp\"\n Found registry modification API: \"RegLoadKeyW\" in \"00000000-00000404.00000000.164306.E702F000.00000002.mdmp\"\n Found registry modification API: \"RegConnectRegistryW\" in \"00000000-00000404.00000000.164306.E702F000.00000002.mdmp\"","id":"string-307","level":"informative","mitre_attack_id":"T1112","name":"Able to create/load registry keys (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" touched \"Windows Defender IOfficeAntiVirus implementation\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{2781761E-28E0-4109-99FE-B9D127C57AFE}\\INPROCSERVER32\")","id":"registry-72","level":"informative","mitre_attack_id":"T1546.015","name":"Overview of unique CLSIDs touched in registry","origin":"Registry Access","relevance":3,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp\")","id":"string-603","level":"informative","mitre_attack_id":"T1486","name":"Able to import cryptographic keys (seen in ransomware)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$35","id":"registry-215","level":"informative","mitre_attack_id":"T1497","name":"Observed a high volume of repeated registry API calls (API Hammering)","origin":"Registry Access","relevance":7,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00008000)","id":"api-147","level":"informative","mitre_attack_id":"T1614","name":"Calls an API typically used to retrieve local language","origin":"API Call","relevance":3,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000404.00000000.164306.E702F000.00000002.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00008000.00000000.164636.01B42000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp\")","id":"string-365","level":"informative","mitre_attack_id":"T1029","name":"Contains ability to perform scheduled transfer (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00008000.00000000.164636.9EDC0000.00000004.mdmp\n 00000000-00008000.00000001.164745.9EDC0000.00000004.mdmp","id":"string-327","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve operating system version","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00008000)","id":"api-179","level":"informative","mitre_attack_id":"T1562.001","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","origin":"API Call","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"General","description":"$36","id":"string-120","level":"informative","mitre_attack_id":"T1012","name":"Contains registry location strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Network Related","description":"$37","id":"string-3","level":"informative","mitre_attack_id":"T1071","name":"Found potential URL in binary/memory","origin":"File/Memory","relevance":3,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '1965055868929', 'hResInfo': '1965055870176'}\" (UID: 00000000-00008000)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1965055868929', 'hResInfo': '1965055870208'}\" (UID: 00000000-00008000)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1965055868929', 'hResInfo': '1965055870224'}\" (UID: 00000000-00008000)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1965055868929', 'hResInfo': '1965055870192'}\" (UID: 00000000-00008000)","id":"api-139","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to load a resource in memory","origin":"API Call","relevance":3,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$38","id":"api-161","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (non-executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$39","id":"string-229","level":"informative","mitre_attack_id":"T1012","name":"Able to query registry keys (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00008000)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","id":"api-135","level":"informative","mitre_attack_id":"T1033","name":"Calls an API typically used to retrieve user name","origin":"API Call","relevance":2,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp\")","id":"string-83","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to enumerate files on disk (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$3a","id":"string-475","level":"informative","mitre_attack_id":"T1555","name":"Contains string like password/secret","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00008000.00000000.164636.84980000.00000004.mdmp, 00000000-00008000.00000001.164745.84980000.00000004.mdmp\")\n Found string \"kerberosclient\" (Indicator: \"kerberos\"; Source: \"00000000-00008000.00000001.164745.8A900000.00000004.mdmp\")","id":"string-868","level":"informative","mitre_attack_id":"T1558","name":"Able to access credential file using Kerberos","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found reference to API \"tripledescryptoserviceprovider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00008000.00000000.164636.8A8E0000.00000004.mdmp\")","id":"string-356","level":"informative","mitre_attack_id":"T1140","name":"Able to decrypt/decode data","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00008000-00000C2C-1536159454\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00008000-00000C2C-1536159940\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00008000-00000C2C-1538578739\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00008000-00000C2C-1538578769\")","id":"string-908","level":"informative","mitre_attack_id":"T1033","name":"Able to query security token membership for user discovery (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$3b","id":"registry-78","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to read software policies","origin":"Registry Access","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"General","description":"Process \"powershell.exe\" with commandline \"-command \"$time=(Get-Date).AddMinutes(8).ToString('HH:mm'); schtasks /create /sc once /st $time /tn 'cream' /tr '%ALLUSERSPROFILE%\\\\Essay\\\\spcache.exe' /f\"\" (UID: 00000000-00008000)","id":"target-110","level":"informative","mitre_attack_id":"T1059.001","name":"Executes powershell with commandline","origin":"Monitored Target","relevance":5,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"General","description":"$3c","id":"target-67","level":"informative","mitre_attack_id":"T1057","name":"Process launched with changed environment","origin":"Monitored Target","relevance":10,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$3d","id":"registry-177","level":"informative","mitre_attack_id":"T1012","name":"Opens registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Found strings \"smss.exe,csrss.exe,wininit.exe,winlogon.exe,services.exe\" (Source: \"00000000-00008000.00000000.164636.96CC0000.00000004.mdmp, 00000000-00008000.00000001.164745.96CC0000.00000004.mdmp\")","id":"string-455","level":"informative","mitre_attack_id":"T1569.002","name":"Contains reference to multiple windows system processes","origin":"File/Memory","relevance":3,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","id":"api-173","level":"informative","mitre_attack_id":"T1083","name":"Tries to access Powershell profile file","origin":"API Call","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"General","description":"\"cmd.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 17790000\n \"reg.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 17790000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 17790000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 16290000\n \"schtasks.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 17790000","id":"module-9","level":"informative","mitre_attack_id":"T1027","name":"Loads the Bcrypt module DLL","origin":"Loaded Module","sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"StartupProfileData-NonInteractive\" has type \"data\"- Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00008000]","id":"binary-0","level":"informative","mitre_attack_id":"T1105","name":"Dropped files","origin":"Binary File","relevance":3,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"System Security","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00008000)","id":"api-111","level":"informative","mitre_attack_id":"T1134","name":"Calls an API typically used to enable or disable privileges in the specified access token","origin":"API Call","relevance":3,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","id":"registry-26","level":"informative","mitre_attack_id":"T1614.001","name":"Reads the windows installation language","origin":"Registry Access","relevance":2,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Network Related","description":"\"2.5.29.37\"\n \"2.5.29.35\"\n \"192.168.0.2\"\n Potential IP \"3.0.0.0\" found in string \"ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35\"\n Potential IP \"3.0.0.0\" found in string \"icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35\"\n Potential IP \"4.0.0.0\" found in string \"ystem.Transactions,4.0.0.0,,b77a5c561934e089\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.14\"\n \"2.5.29.15\"\n \"2.5.29.32\"\n \"2.5.29.19\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.31\"\n \"2.5.29.17\"\n \"2.5.29.1\"\n \"2.5.4.3\"\n \"2.5.29.10\"\n \"2.5.4.8\"\n \"2.5.4.7\"\n \"2.5.4.10\"\n \"2.5.4.11\"\n \"2.5.4.5\"\n \"2.5.4.6\"\n \"2.5.29.16\"\n Potential IP \"4.0.0.0\" found in string \"n=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\"\n Potential IP \"4.0.0.0\" found in string \"rsion=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\"","id":"string-14","level":"informative","mitre_attack_id":"T1071","name":"Found potential IP address in binary/memory","origin":"File/Memory","sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Remote Access Related","description":"Found string \"+ncalrpc:[OLEFE5FFFF4FEEB12F5177C73411CF0]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00008000.00000000.164636.84980000.00000004.mdmp, 00000000-00008000.00000001.164745.84980000.00000004.mdmp\")","id":"string-531","level":"informative","mitre_attack_id":"T1090","name":"Contains references to RPC protocol sequence strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Process \"powershell.exe\" with commandline \"-command \"$time=(Get-Date).AddMinutes(8).ToString('HH:mm'); schtasks /create /sc once /st $time /tn 'cream' /tr '%ALLUSERSPROFILE%\\\\Essay\\\\spcache.exe' /f\"\" (UID: 00000000-00008000)","id":"target-289","level":"informative","mitre_attack_id":"T1082","name":"Attempts to get system information using PowerShell","origin":"Monitored Target","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$3e","id":"api-11","level":"informative","mitre_attack_id":"T1082","name":"Queries volume information","origin":"API Call","relevance":2,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"General","description":"$3f","id":"api-22","level":"informative","mitre_attack_id":"T1129","name":"Fails to load modules at runtime","origin":"API Call","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp\")","id":"string-310","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to load modules (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00000404.00000000.164306.E702F000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp\")","id":"string-205","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"System Security","description":"Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00008000.00000000.164636.01B42000.00000002.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00008000.00000000.164636.01B42000.00000002.mdmp\")","id":"string-748","level":"informative","mitre_attack_id":"T1562.001","name":"Contains ability to disable Windows Defender using PowerShell","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00008000)","id":"api-124","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get product type","origin":"API Call","relevance":3,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp\")","id":"string-450","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to determine if process is running under WOW64 (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"General","description":"\"19001a000000000040c7c516fb7f0000@ntdll.dll\"\n \"220023000000000018c7c516fb7f0000@ntdll.dll\"","id":"api-8","level":"informative","mitre_attack_id":"T1129","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","origin":"API Call","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$40","id":"string-57","level":"informative","mitre_attack_id":"T1027","name":"Contains CRYPTO related strings","origin":"File/Memory","relevance":3,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000404.00000000.164306.E702F000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00008000.00000000.164636.01B42000.00000002.mdmp, 00000000-00008000.00000000.164636.D8D4A000.00000002.mdmp\")","id":"string-427","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve a module handle (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00008000.00000000.164636.01B42000.00000002.mdmp\")","id":"string-82","level":"informative","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69aabd051413fd04630e5211","report_type":"sandbox"}]}],"stats":{"attributions":{"campaigns_count":0,"cves_count":0,"malware_families_count":0,"threat_actors_count":0,"threat_types_count":0},"av":{"malicious_count":0,"suspicious_count":0,"total_engines":26},"mitre_attacks":{"total":63},"rule_matches":{"sigma_count":0,"suricata_count":0,"yara_count":0},"sandbox_signatures":{"informative_count":149,"malicious_count":4,"suspicious_count":6,"total":159}},"summary":{"score":85,"tags":null,"verdict":"malicious"}},"metadata":{"file_info":{"file_name":"evidencelumber.bat","file_size":7075,"file_type":["script","bat"],"file_type_id":"bat"},"hashes":{"imphash":"Unknown","md5":"453a4b09014e457346f4aa06d7e456de","sha1":"b1a13a8bb1e3f763aacfe7f6090b2456496eeb97","sha256":"2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b","sha512":"18a4b53dce9da35e0d60991b97aa8f6b9aca003f12ab92658153a310655865107d8a455f24a56b0281830eed6b0e914cac20154afa06b3cb55062c64e7bf03c5","ssdeep":"192:4UBmYXJjRm35n34+e3JC9n5o0HwJC8MkEGMJPvo96K8Xcca:4UBmkhS3re3JCJG0HwJC8vEvA9TgcV","ssdeep_chunks":["192:4UBmYXJ","192:UBmYXJj","192:BmYXJjR","192:mYXJjRm","192:YXJjRm3","192:XJjRm35","192:JjRm35n","192:jRm35n3","192:Rm35n34","192:m35n34+","192:35n34+e","192:5n34+e3","192:n34+e3J","192:34+e3JC","192:4+e3JC9","192:+e3JC9n","192:e3JC9n5","192:3JC9n5o","192:JC9n5o0","192:C9n5o0H","192:9n5o0Hw","192:n5o0HwJ","192:5o0HwJC","192:o0HwJC8","192:0HwJC8M","192:HwJC8Mk","192:wJC8MkE","192:JC8MkEG","192:C8MkEGM","192:8MkEGMJ","192:MkEGMJP","192:kEGMJPv","192:EGMJPvo","192:GMJPvo9","192:MJPvo96","192:JPvo96K","192:Pvo96K8","192:vo96K8X","192:o96K8Xc","192:96K8Xcc","192:6K8Xcca","384:4UBmYXJ","384:UBmYXJj","384:BmYXJjR","384:mYXJjRm","384:YXJjRm3","384:XJjRm35","384:JjRm35n","384:jRm35n3","384:Rm35n34","384:m35n34+","384:35n34+e","384:5n34+e3","384:n34+e3J","384:34+e3JC","384:4+e3JC9","384:+e3JC9n","384:e3JC9n5","384:3JC9n5o","384:JC9n5o0","384:C9n5o0H","384:9n5o0Hw","384:n5o0HwJ","384:5o0HwJC","384:o0HwJC8","384:0HwJC8M","384:HwJC8Mk","384:wJC8MkE","384:JC8MkEG","384:C8MkEGM","384:8MkEGMJ","384:MkEGMJP","384:kEGMJPv","384:EGMJPvo","384:GMJPvo9","384:MJPvo96","384:JPvo96K","384:Pvo96K8","384:vo96K8X","384:o96K8Xc","384:96K8Xcc","384:6K8Xcca","192:4UBmkhS","192:UBmkhS3","192:BmkhS3r","192:mkhS3re","192:khS3re3","192:hS3re3J","192:S3re3JC","192:3re3JCJ","192:re3JCJG","192:e3JCJG0","192:3JCJG0H","192:JCJG0Hw","192:CJG0HwJ","192:JG0HwJC","192:G0HwJC8","192:0HwJC8v","192:HwJC8vE","192:wJC8vEv","192:JC8vEvA","192:C8vEvA9","192:8vEvA9T","192:vEvA9Tg","192:EvA9Tgc","192:vA9TgcV"]},"submissions":{"first_seen":1772796937000,"last_multi_scan":1772797189000,"last_seen":1772797189000}},"overall_status":"SUCCESS","report_ids":{"sandbox_job_ids":["69aabd051413fd04630e5211"]},"schema_version":"1.0.9","sha256":"2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b","threat_score":85,"unified_at":"2026-09-06T07:46:36.909Z","unified_at_epoch_ms":1788680796909,"verdict":"malicious"}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Sample 2ef95cd2ef6b… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 2ef95cd2ef6b…. Threat score 85/100. 0/26 AV engines flagged this file. 4 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 2ef95cd2ef6b… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 2ef95cd2ef6b…. Threat score 85/100. 0/26 AV engines flagged this file. 4 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/2ef95cd2ef6b59eddc3283a77e818442ff330a860199c61a7e16c0bd5b24091b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 2ef95cd2ef6b… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 2ef95cd2ef6b…. Threat score 85/100. 0/26 AV engines flagged this file. 4 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L41","11",{}]]