24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 44:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4d8,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_60% Sample 48ba9d74b887… — Score 76/100 — Hybrid Analysis","description":"Malicious verdict for sample 48ba9d74b887…. Malware family: Win/malicious_confidence_60%. Threat score 76/100. 2/25 AV engines flagged this file. 1 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/48ba9d74b887ca93d6b36115f42a433004ee19ec1039b3e8173f4ca821210d5b","keywords":["Malicious","Win/malicious_confidence_60%","malware analysis","sandbox report","threat intelligence","48ba9d74b887ca93d6b36115f42a433004ee19ec1039b3e8173f4ca821210d5b"],"about":{"@type":"SoftwareApplication","name":"Sentinel-Local-Agent-v0.3.2.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"48ba9d74b887ca93d6b36115f42a433004ee19ec1039b3e8173f4ca821210d5b","additionalType":"Malicious sample"},"threatScore":76,"malwareFamily":"Win/malicious_confidence_60%","antivirusDetections":{"malicious":2,"total":25},"behavioralIndicators":{"malicious":1,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T5cc,Found string "" } if ($item.startedAt) { [void][DateTimeOffset]::Parse($item.startedAt) } } $serialized = $timeline | ConvertTo-Json -Depth 8 -Compress if ($serialized -match '"(CommandLine|ExecutablePath|UserName)"') { throw "" (Indicator: "ConvertTo-Json"; File: "Sentinel-Local-Agent-v0.3.2.exe"), file/memory contains long string with (Indicator: "ConvertTo-Json"; File: "Sentinel-Local-Agent-v0.3.2.exe"), Found string "$serialized = $timeline | ConvertTo-Json -Depth 8 -Compress" (Indicator: "ConvertTo-Json"; Source: "00000000-00003792.00000001.104588.00082000.00000002.mdmp"), Found string "$backup | ConvertTo-Json -Depth 6 | Set-Content -LiteralPath $backupPath -Encoding UTF8" (Indicator: "ConvertTo-Json"; Source: "00000000-00003792.00000001.104588.00082000.00000002.mdmp"), Found string "$body = Get-ProcessTimeline | ConvertTo-Json -Depth 8 -Compress" (Indicator: "ConvertTo-Json"; Source: "00000000-00003792.00000001.104588.00082000.00000002.mdmp"), Found string "$actionBody = $actionResult | ConvertTo-Json -Depth 4 -Compress" (Indicator: "ConvertTo-Json"; Source: "00000000-00003792.00000001.104588.00082000.00000002.mdmp"), Found string "} | ConvertTo-Json -Compress" (Indicator: "ConvertTo-Json"; Source: "00000000-00003792.00000001.104588.00082000.00000002.mdmp"), Found string "$snapshot = Get-DetectionSnapshot | ConvertTo-Json -Depth 8 -Compress" (Indicator: "ConvertTo-Json"; Source: "00000000-00003792.00000001.104588.00082000.00000002.mdmp")26:T888,"Sentinel-Local-Agent-v0.3.2.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\67D147D5DAB7F28D663CA5B7A9568F087427B9F7") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\67D147D5DAB7F28D663CA5B7A9568F087427B9F7") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\902EF2DEEB3C5B13EA4C3D5193629309E231AE55") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\902EF2DEEB3C5B13EA4C3D5193629309E231AE55")27:T5a4,Contains base64 string in header "/security/hybrid" in header "GET /security/hybrid-analysis-report.json HTTP/1.1User-Agent: SentinelLocalAgent/0.3.2Host: valorant.yukiqwq.cnCache-Control: no-store,no-cachePragma: no-cacheConnection: Keep-Alive" Contains base64 string in header "analysis" in header "GET /security/hybrid-analysis-report.json HTTP/1.1User-Agent: SentinelLocalAgent/0.3.2Host: valorant.yukiqwq.cnCache-Control: no-store,no-cachePragma: no-cacheConnection: Keep-Alive" Contains base64 string in header "json" in header "GET /security/hybrid-analysis-report.json HTTP/1.1User-Agent: SentinelLocalAgent/0.3.2Host: valorant.yukiqwq.cnCache-Control: no-store,no-cachePragma: no-cacheConnection: Keep-Alive" Contains base64 string in header "SentinelLocalAgent/0" in header "GET /security/hybrid-analysis-report.json HTTP/1.1User-Agent: SentinelLocalAgent/0.3.2Host: valorant.yukiqwq.cnCache-Control: no-store,no-cachePragma: no-cacheConnection: Keep-Alive" Contains base64 string in header "valorant" in header "GET /security/hybrid-analysis-report.json HTTP/1.1User-Agent: SentinelLocalAgent/0.3.2Host: valorant.yukiqwq.cnCache-Control: no-store,no-cachePragma: no-cacheConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /security/hybrid-analysis-report.json HTTP/1.1User-Agent: SentinelLocalAgent/0.3.2Host: valorant.yukiqwq.cnCache-Control: no-store,no-cachePragma: no-cacheConnection: Keep-Alive"28:Tafd,"Sentinel-Local-Agent-v0.3.2.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "")29:Te0e,"Sentinel-Local-Agent-v0.3.2.exe" queries volume information of "C:\Sentinel-Local-Agent-v0.3.2.exe" at 00000000-00003792-00000C17-600445556 "Sentinel-Local-Agent-v0.3.2.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll" at 00000000-00003792-00000C17-601148783 "Sentinel-Local-Agent-v0.3.2.exe" queries volume information of "C:\Windows\Fonts\segoeuib.ttf" at 00000000-00003792-00000C17-601453801 "Sentinel-Local-Agent-v0.3.2.exe" queries volume information of "C:\Windows\Fonts\segoeui.ttf" at 00000000-00003792-00000C17-601470099 "Sentinel-Local-Agent-v0.3.2.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXml.dll" at 00000000-00003792-00000C17-601476861 "Sentinel-Local-Agent-v0.3.2.exe" queries volume information of "C:\Windows\Fonts\msyhbd.ttc" at 00000000-00003792-00000C17-601528140 "Sentinel-Local-Agent-v0.3.2.exe" queries volume information of "C:\Windows\Fonts\msyh.ttc" at 00000000-00003792-00000C17-601541710 "Sentinel-Local-Agent-v0.3.2.exe" queries volume information of "C:\Windows\Fonts\segoeuib.ttf" at 00000000-00003792-00000C17-601544920 "Sentinel-Local-Agent-v0.3.2.exe" queries volume information of "C:\Windows\Fonts\msyh.ttc" at 00000000-00003792-00000C17-601556936 "Sentinel-Local-Agent-v0.3.2.exe" queries volume information of "C:\Windows\Fonts\msyhbd.ttc" at 00000000-00003792-00000C17-601571102 "Sentinel-Local-Agent-v0.3.2.exe" queries volume information of "C:\Windows\Fonts\segoeuib.ttf" at 00000000-00003792-00000C17-601577195 "Sentinel-Local-Agent-v0.3.2.exe" queries volume information of "C:\Windows\Fonts\msyh.ttc" at 00000000-00003792-00000C17-601584826 "Sentinel-Local-Agent-v0.3.2.exe" queries volume information of "C:\Windows\Fonts\segoeuib.ttf" at 00000000-00003792-00000C17-601595555 "Sentinel-Local-Agent-v0.3.2.exe" queries volume information of "C:\Windows\Fonts\msyhbd.ttc" at 00000000-00003792-00000C17-601599108 "Sentinel-Local-Agent-v0.3.2.exe" queries volume information of "C:\Windows\Fonts\segoeuib.ttf" at 00000000-00003792-00000C17-601602887 "Sentinel-Local-Agent-v0.3.2.exe" queries volume information of "C:\Windows\Fonts\msyhbd.ttc" at 00000000-00003792-00000C17-601604252 "Sentinel-Local-Agent-v0.3.2.exe" queries volume information of "C:\Windows\Fonts\segoeuib.ttf" at 00000000-00003792-00000C17-601608928 "Sentinel-Local-Agent-v0.3.2.exe" queries volume information of "C:\Windows\Fonts\msyhbd.ttc" at 00000000-00003792-00000C17-601610462 "Sentinel-Local-Agent-v0.3.2.exe" queries volume information of "C:\Windows\Fonts\segoeuib.ttf" at 00000000-00003792-00000C17-601613299 "Sentinel-Local-Agent-v0.3.2.exe" queries volume information of "C:\Windows\Fonts\msyhbd.ttc" at 00000000-00003792-00000C17-601614784 "Sentinel-Local-Agent-v0.3.2.exe" queries volume information of "C:\Windows\Fonts\msyh.ttc" at 00000000-00003792-00000C17-601617055 "Sentinel-Local-Agent-v0.3.2.exe" queries volume information of "C:\Windows\Fonts\segoeuib.ttf" at 00000000-00003792-00000C17-601632311 "Sentinel-Local-Agent-v0.3.2.exe" queries volume information of "C:\Windows\Fonts\segoeui.ttf" at 00000000-00003792-00000C17-601635089 "Sentinel-Local-Agent-v0.3.2.exe" queries volume information of "C:\Windows\Fonts\msyh.ttc" at 00000000-00003792-00000C17-601636647 "Sentinel-Local-Agent-v0.3.2.exe" queries volume information of "C:\Windows\Fonts\segoeuib.ttf" at 00000000-00003792-00000C17-6016376412a:T5b5,"Sentinel-Local-Agent-v0.3.2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "Sentinel-Local-Agent-v0.3.2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "Sentinel-Local-Agent-v0.3.2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "Sentinel-Local-Agent-v0.3.2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\043E4AD5D7CD1251BED7D5DEB038CDA7ED1481B7"; Key: "BLOB") "Sentinel-Local-Agent-v0.3.2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "Sentinel-Local-Agent-v0.3.2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "Sentinel-Local-Agent-v0.3.2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "Sentinel-Local-Agent-v0.3.2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "Sentinel-Local-Agent-v0.3.2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "Sentinel-Local-Agent-v0.3.2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB")2b:T1905,"$filesPresent) $serviceRunning = [bool]($vgc.state -eq "Running") $driverRunning = [bool]($vgk.state -eq "Running") if (-not $installed) { $state = "not_installed" } elseif ($driverRunning) { $state = "running" } elseif ($serviceRunning -or $vgcProcess -or $trayProcess) { $state = "partial" } else { $state = "installed_stopped" } return [ordered]@{ installed = $installed state = $state processRunning = [bool]$trayProcess trayRunning = [bool]$trayProcess vgcProcessRunning = [bool]$vgcProcess filesPresent = [bool]$filesPresent services = [ordered]@{ vgc = $vgc vgk = $vgk } }}function Get-HvciStatus { $registryPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" $registryEnabled = $false $registryReadable = $true try { $registryValue = Get-ItemPropertyValue -LiteralPat" in Source: Sentinel-Local-Agent-v0.3.2.exe "lseif (-not $registryReadable -and -not $deviceGuardReadable) { $state = "unknown" } else { $state = "disabled" } return [ordered]@{ enabled = $running configured = $configured state = $state registryEnabled = $registryEnabled virtualizationBasedSecurityStatus = $vbsStatus sources = [ordered]@{ registryReadable = $registryReadable deviceGuardReadable = $deviceGuardReadable } }}function Get-SecureBootStatus { $enabled = $null $supported = $null $registryReadable = $false $cmdletReadable = $false $registryPath = "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\State" try { $registryValue = Get-ItemPropertyValue -LiteralPath $registryPath -Name "UEFISecureBootEnabled" -ErrorAction Stop $enabled = ([int]$registryValue -eq 1) $supported = $true $registryReadable = $true } catch {} try { $cmdletValue = Confirm-SecureBo" in Source: Sentinel-Local-Agent-v0.3.2.exe "[bool]$tpm.TpmEnabled $activated = [bool]$tpm.TpmActivated $cmdletReadable = $true } } catch {} try { $tpmRegistry = Get-ItemProperty -LiteralPath "HKLM:\SYSTEM\CurrentControlSet\Services\TPM\WMI" -ErrorAction Stop $present = $true if ($null -ne $tpmRegistry.TaskReadyForStorage) { $ready = ([int]$tpmRegistry.TaskReadyForStorage -eq 1) } if ($null -ne $tpmRegistry.FirmwareVersionAtLastProvision) { $firmwareVersion = [string]$tpmRegistry.FirmwareVersionAtLastProvision } $registryReadable = $true } catch { if (Test-Path -LiteralPath "HKLM:\SYSTEM\CurrentControlSet\Services\TPM") { $present = $true } } try { $toolOutput = & "$env:SystemRoot\System32\tpmtool.exe" getdeviceinformation 2>$null $toolText = $toolOutput -join "`n" if (-not [string]::IsNullOrWhiteSpace($toolText)) { $toolReadable = $true" in Source: Sentinel-Local-Agent-v0.3.2.exe "" } } $elevatedCommand = @'$ErrorActionPreference = "Stop"$deviceGuardPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard"$hvciPath = "$deviceGuardPath\Scenarios\HypervisorEnforcedCodeIntegrity"function Read-RegistryValue { param([string]$Path, [string]$Name) try { return [ordered]@{ exists = $true; value = Get-ItemPropertyValue -LiteralPath $Path -Name $Name -ErrorAction Stop } } catch { return [ordered]@{ exists = $false; value = $null } }}function Restore-RegistryValue { param([string]$Path, [string]$Name, $SavedValue) if ($SavedValue.exists) { New-Item -Path $Path -Force | Out-Null New-ItemProperty -Path $Path -Name $Name -PropertyType DWord -Value ([int]$SavedValue.value) -Force | Out-Null } else { Remove-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue }}try { $secureBootEnabled = $false try { $secureBootEnabled = [bool](Confirm-SecureBootUEFI -ErrorAction S" in Source: Sentinel-Local-Agent-v0.3.2.exe, "top) } catch { try { $secureBootEnabled = ([int](Get-ItemPropertyValue -LiteralPath "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\State" -Name "UEFISecureBootEnabled" -ErrorAction Stop) -eq 1) } catch { $secureBootEnabled = $false } } if (-not $secureBootEnabled) { exit 5 } $backupDirectory = Join-Path $env:ProgramData "SentinelEnvironmentAgent\backups" New-Item -ItemType Directory -Path $backupDirectory -Force | Out-Null $backupPath = Join-Path $backupDirectory ("hvci-before-{0}.json" -f (Get-Date -Format "yyyyMMdd-HHmmss")) $backup = [ordered]@{ createdAt = [DateTimeOffset]::Now.ToString("o") deviceGuardPath = $deviceGuardPath hvciPath = $hvciPath values = [ordered]@{ EnableVirtualizationBasedSecurity = Read-RegistryValue $deviceGuardPath "EnableVirtualizationBasedSecurity" RequirePlatformSecurityFeatures = Read-RegistryValue $deviceGuardPath "RequirePlatformSecurityFeatures"" in Source: Sentinel-Local-Agent-v0.3.2.exe, "$registryPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity"" in Source: 00000000-00003792.00000001.104588.00082000.00000002.mdmp, "$registryPath = "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\State"" in Source: 00000000-00003792.00000001.104588.00082000.00000002.mdmp, "$tpmRegistry = Get-ItemProperty -LiteralPath "HKLM:\SYSTEM\CurrentControlSet\Services\TPM\WMI" -ErrorAction Stop" in Source: 00000000-00003792.00000001.104588.00082000.00000002.mdmp, "if (Test-Path -LiteralPath "HKLM:\SYSTEM\CurrentControlSet\Services\TPM") {" in Source: 00000000-00003792.00000001.104588.00082000.00000002.mdmp, "$deviceGuardPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard"" in Source: 00000000-00003792.00000001.104588.00082000.00000002.mdmp, "$secureBootEnabled = ([int](Get-ItemPropertyValue -LiteralPath "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\State" -Name "UEFISecureBootEnabled" -ErrorAction Stop) -eq 1)" in Source: 00000000-00003792.00000001.104588.00082000.00000002.mdmp, "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003792.00000001.104588.21720000.00000004.mdmp 00000000-00003792.00000002.106510.21720000.00000004.mdmp2c:T566,Process Sentinel-Local-Agent-v0.3.2.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\RasPbFile" Process Sentinel-Local-Agent-v0.3.2.exe created mutex with name "SM0:3792:304:WilStaging_02" Process Sentinel-Local-Agent-v0.3.2.exe created mutex with name "__DDrawExclMode__" Process Sentinel-Local-Agent-v0.3.2.exe created mutex with name "SM0:3792:120:WilError_01" Process Sentinel-Local-Agent-v0.3.2.exe created mutex with name "Local\SM0:3792:304:WilStaging_02" Process Sentinel-Local-Agent-v0.3.2.exe created mutex with name "__DDrawCheckExclMode__" Process Sentinel-Local-Agent-v0.3.2.exe created mutex with name "Global\RasPbFile" Process Sentinel-Local-Agent-v0.3.2.exe created mutex with name "\Sessions\1\BaseNamedObjects\__DDrawExclMode__" Process Sentinel-Local-Agent-v0.3.2.exe created mutex with name "\Sessions\1\BaseNamedObjects\__DDrawCheckExclMode__" Process Sentinel-Local-Agent-v0.3.2.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3792:304:WilStaging_02" Process Sentinel-Local-Agent-v0.3.2.exe created mutex with name "\BaseNamedObjects\CLR_PerfMon_WrapMutex" Process Sentinel-Local-Agent-v0.3.2.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3792:304:WilStaging_02" Process Sentinel-Local-Agent-v0.3.2.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3792:120:WilError_01"2d:T52f," $registryPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity"" in Source: 00000000-00003792.00000001.104588.00082000.00000002.mdmp " $registryPath = "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\State"" in Source: 00000000-00003792.00000001.104588.00082000.00000002.mdmp " $tpmRegistry = Get-ItemProperty -LiteralPath "HKLM:\SYSTEM\CurrentControlSet\Services\TPM\WMI" -ErrorAction Stop" in Source: 00000000-00003792.00000001.104588.00082000.00000002.mdmp " if (Test-Path -LiteralPath "HKLM:\SYSTEM\CurrentControlSet\Services\TPM") {" in Source: 00000000-00003792.00000001.104588.00082000.00000002.mdmp "$deviceGuardPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard"" in Source: 00000000-00003792.00000001.104588.00082000.00000002.mdmp " $secureBootEnabled = ([int](Get-ItemPropertyValue -LiteralPath "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\State" -Name "UEFISecureBootEnabled" -ErrorAction Stop) -eq 1)" in Source: 00000000-00003792.00000001.104588.00082000.00000002.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003792.00000001.104588.21720000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003792.00000002.106510.21720000.00000004.mdmp2e:T425,"GET /security/hybrid-analysis-report.json HTTP/1.1 User-Agent: SentinelLocalAgent/0.3.2 Host: valorant.yukiqwq.cn Cache-Control: no-store,no-cache Pragma: no-cache Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Server: nginx Date: Tue 06 Oct 2026 14:50:31 GMT Content-Type: application/json Content-Length: 780 Last-Modified: Thu 01 Oct 2026 07:13:17 GMT Connection: keep-alive ETag: "6abe080d-30c" Strict-Transport-Security: max-age=300 X-Content-Type-Options: nosniff X-Frame-Options: DENY Referrer-Policy: strict-origin-when-cross-origin Permissions-Policy: camera=() microphone=() geolocation=() Content-Security-Policy: default-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data:; script-src 'self'; connect-src http://127.0.0.1:17831; frame-ancestors 'none'; base-uri 'self'; form-action 'self' Accept-Ranges: bytes with response body ==>7B0D0A202022736368656D6156657273696F6E223A20312C0D0A20202270726F64756374223A202256616C6F72616E7420C3A6C2B8C2B8C3A6C288C28FC3A7C2.......2f:Tf56,file/memory contains long string with (Indicator: "Join-Path"; File: "Sentinel-Local-Agent-v0.3.2.exe") file/memory contains long string with (Indicator: "Test-Path"; File: "Sentinel-Local-Agent-v0.3.2.exe") file/memory contains long string with (Indicator: "Write-Output"; File: "Sentinel-Local-Agent-v0.3.2.exe") file/memory contains long string with (Indicator: "New-Object"; File: "Sentinel-Local-Agent-v0.3.2.exe") file/memory contains long string with (Indicator: "Confirm-SecureBootUEFI"; File: "Sentinel-Local-Agent-v0.3.2.exe") file/memory contains long string with (Indicator: "Write-Host"; File: "Sentinel-Local-Agent-v0.3.2.exe") Found string "" -ForegroundColor Green Write-Host "" (Indicator: "Write-Host"; File: "Sentinel-Local-Agent-v0.3.2.exe") Found string "v$AgentVersion" -ForegroundColor Red Write-Host " ----------------------------------------" Write-Host "" (Indicator: "Write-Host"; File: "Sentinel-Local-Agent-v0.3.2.exe") Found string ": http://127.0.0.1:$Port" -ForegroundColor Cyan Write-Host "" (Indicator: "Write-Host"; File: "Sentinel-Local-Agent-v0.3.2.exe") Found string "HVCI" -ForegroundColor Green Write-Host "" (Indicator: "Write-Host"; File: "Sentinel-Local-Agent-v0.3.2.exe") Found string "$DataDirectory = Join-Path $env:LOCALAPPDATA "SentinelEnvironmentAgent"" (Indicator: "Join-Path"; Source: "00000000-00003792.00000001.104588.00082000.00000002.mdmp") Found string "$LogPath = Join-Path $DataDirectory "agent.log"" (Indicator: "Join-Path"; Source: "00000000-00003792.00000001.104588.00082000.00000002.mdmp") Found string "$PidPath = Join-Path $DataDirectory "agent.pid"" (Indicator: "Join-Path"; Source: "00000000-00003792.00000001.104588.00082000.00000002.mdmp") Found string "$installDirectory = Join-Path ${env:ProgramFiles} "Riot Vanguard"" (Indicator: "Join-Path"; Source: "00000000-00003792.00000001.104588.00082000.00000002.mdmp") Found string "$filesPresent = Test-Path -LiteralPath $installDirectory" (Indicator: "Test-Path"; Source: "00000000-00003792.00000001.104588.00082000.00000002.mdmp") Found string "$cmdletValue = Confirm-SecureBootUEFI -ErrorAction Stop" (Indicator: "Confirm-SecureBootUEFI"; Source: "00000000-00003792.00000001.104588.00082000.00000002.mdmp") Found string "if (Test-Path -LiteralPath "HKLM:\SYSTEM\CurrentControlSet\Services\TPM") {" (Indicator: "Test-Path"; Source: "00000000-00003792.00000001.104588.00082000.00000002.mdmp") Found string "Write-Output "PROCESS_SELF_TEST_OK"" (Indicator: "Write-Output"; Source: "00000000-00003792.00000001.104588.00082000.00000002.mdmp") Found string "$headers = New-Object System.Collections.Generic.List[string]" (Indicator: "New-Object"; Source: "00000000-00003792.00000001.104588.00082000.00000002.mdmp") Found string "try { $secureBootEnabled = [bool](Confirm-SecureBootUEFI -ErrorAction Stop) } catch {" (Indicator: "Confirm-SecureBootUEFI"; Source: "00000000-00003792.00000001.104588.00082000.00000002.mdmp") Found string "$backupDirectory = Join-Path $env:ProgramData "SentinelEnvironmentAgent\backups"" (Indicator: "Join-Path"; Source: "00000000-00003792.00000001.104588.00082000.00000002.mdmp") Found string "$backupPath = Join-Path $backupDirectory ("hvci-before-{0}.json" -f (Get-Date -Format "yyyyMMdd-HHmmss"))" (Indicator: "Join-Path"; Source: "00000000-00003792.00000001.104588.00082000.00000002.mdmp") Found string "Write-Host """ (Indicator: "Write-Host"; Source: "00000000-00003792.00000001.104588.00082000.00000002.mdmp") Found string "Write-Host " Sentinel" (Indicator: "Write-Host"; Source: "00000000-00003792.00000001.104588.00082000.00000002.mdmp"), Found string "Write-Host "" (Indicator: "Write-Host"; Source: "00000000-00003792.00000001.104588.00082000.00000002.mdmp") Found string "Write-Host " ----------------------------------------"" (Indicator: "Write-Host"; Source: "00000000-00003792.00000001.104588.00082000.00000002.mdmp")30:T49c,"Sentinel-Local-Agent-v0.3.2.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"31:T6ed,"Sentinel-Local-Agent-v0.3.2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SENTINEL-LOCAL-AGENT-V0.3.2.EXE"; Key: ""; Value: "") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\DIRECT3D"; Key: ""; Value: "") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\DIRECT3D\DRIVERS"; Key: ""; Value: "") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\DIRECT3D"; Key: ""; Value: "") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\GRAPHICSDRIVERS\SCHEDULER"; Key: ""; Value: "") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\DIRECT3D\DRIVERS"; Key: ""; Value: "") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "OPEN"; Path: "HKCU\SYSTEM\CURRENTCONTROLSET\CONTROL\GRAPHICSDRIVERS\SCHEDULER"; Key: ""; Value: "") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "OPEN"; Path: "HKLM\HARDWARE\DEVICEMAP\VIDEO"; Key: ""; Value: "") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\VIDEO\{2DAE80E0-0637-11EE-9C2C-806E6F6E6963}\0000"; Key: ""; Value: "")32:T83f,"Sentinel-Local-Agent-v0.3.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "IDLETIMERWINDOW"; Value: "") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "65CD4C8A-0848-4583-92A0-31C0FBAF00C0"; Value: "") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "783ACA0A-790E-4D7F-8451-AA850511C6B9"; Value: "") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B0F726CB-CA9C-4C11-B5B4-8C65AAE214E9"; Value: "") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\HARDWARE\DEVICEMAP\VIDEO"; Key: "MAXOBJECTNUMBER"; Value: "") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\HARDWARE\DEVICEMAP\VIDEO"; Key: "\DEVICE\VIDEO0"; Value: "") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E968-E325-11CE-BFC1-08002BE10318}\0002"; Key: "PRUNINGMODE"; Value: "") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\PCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&18D45AA6&0&78"; Key: "HARDWAREID"; Value: "") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\HARDWARE\DEVICEMAP\VIDEO"; Key: "\DEVICE\VIDEO1"; Value: "") "Sentinel-Local-Agent-v0.3.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\HARDWARE\DEVICEMAP\VIDEO"; Key: "\DEVICE\VIDEO2"; Value: "")33:T64c,"Sentinel-Local-Agent-v0.3.2.exe" reads file "c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config" "Sentinel-Local-Agent-v0.3.2.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll.aux" "Sentinel-Local-Agent-v0.3.2.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\presentatio5ae0f00f#\ec5e61c1f67279c3ebe8bd1160c680a7\presentationframework.ni.dll.aux" "Sentinel-Local-Agent-v0.3.2.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\windowsbase\40bd456a59a4969ec46e7d7fef6b5e32\windowsbase.ni.dll.aux" "Sentinel-Local-Agent-v0.3.2.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.core\0d59b0e237d7519417de10cd84bda4e7\system.core.ni.dll.aux" "Sentinel-Local-Agent-v0.3.2.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system\e43dd9c73ab5615e461bf5109c3facd6\system.ni.dll.aux" "Sentinel-Local-Agent-v0.3.2.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\presentationcore\2e48700efecd23d15226baaa35a854bb\presentationcore.ni.dll.aux" "Sentinel-Local-Agent-v0.3.2.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.xaml\0212deecd5dfa435c6588fd68900ab8c\system.xaml.ni.dll.aux" "Sentinel-Local-Agent-v0.3.2.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\system.configuration.ni.dll.aux" "Sentinel-Local-Agent-v0.3.2.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.xml\5ee35debfc22f727e70e4479ddcbc045\system.xml.ni.dll.aux"34:T4f4,"Sentinel-Local-Agent-v0.3.2.exe" trying to touch file "C:\Windows\System32\mscoree.dll" "Sentinel-Local-Agent-v0.3.2.exe" trying to touch file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL" "Sentinel-Local-Agent-v0.3.2.exe" trying to touch file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "Sentinel-Local-Agent-v0.3.2.exe" trying to touch file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "Sentinel-Local-Agent-v0.3.2.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" "Sentinel-Local-Agent-v0.3.2.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "Sentinel-Local-Agent-v0.3.2.exe" trying to touch file "C:\WINDOWS\SYSTEM32\kernelbase.dll" "Sentinel-Local-Agent-v0.3.2.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "Sentinel-Local-Agent-v0.3.2.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll" "Sentinel-Local-Agent-v0.3.2.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll" "Sentinel-Local-Agent-v0.3.2.exe" trying to touch file "\Device\CNG" "Sentinel-Local-Agent-v0.3.2.exe" trying to touch file "C:\Windows\System32\imm32.dll" "Sentinel-Local-Agent-v0.3.2.exe" trying to touch file "C:\WINDOWS\system32\IMM32.DLL"35:Tb8a,"Sentinel-Local-Agent-v0.3.2.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "Sentinel-Local-Agent-v0.3.2.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "Sentinel-Local-Agent-v0.3.2.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "Sentinel-Local-Agent-v0.3.2.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "Sentinel-Local-Agent-v0.3.2.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "Sentinel-Local-Agent-v0.3.2.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "Sentinel-Local-Agent-v0.3.2.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "Sentinel-Local-Agent-v0.3.2.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "Sentinel-Local-Agent-v0.3.2.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "Sentinel-Local-Agent-v0.3.2.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "Sentinel-Local-Agent-v0.3.2.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "Sentinel-Local-Agent-v0.3.2.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "Sentinel-Local-Agent-v0.3.2.exe" trying to access non-existent file "C:\CRYPTSP.dll" "Sentinel-Local-Agent-v0.3.2.exe" trying to access non-existent file "C:\BCRYPT.DLL" "Sentinel-Local-Agent-v0.3.2.exe" trying to access non-existent file "C:\bcrypt.dll" "Sentinel-Local-Agent-v0.3.2.exe" trying to access non-existent file "C:\CRYPTBASE.DLL" "Sentinel-Local-Agent-v0.3.2.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "Sentinel-Local-Agent-v0.3.2.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\UCRTBASE_CLR0400.DLL" "Sentinel-Local-Agent-v0.3.2.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" "Sentinel-Local-Agent-v0.3.2.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.DLL" "Sentinel-Local-Agent-v0.3.2.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" "Sentinel-Local-Agent-v0.3.2.exe" trying to access non-existent file "C:\MSVCP140_CLR0400.DLL" "Sentinel-Local-Agent-v0.3.2.exe" trying to access non-existent file "C:\MSVCP140_CLR0400.dll"36:T863,"Sentinel-Local-Agent-v0.3.2.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "Sentinel-Local-Agent-v0.3.2.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "Sentinel-Local-Agent-v0.3.2.exe" trying to access non-existent file "C:\SENTINEL-LOCAL-AGENT-V0.3.2.EXE.CONFIG" "Sentinel-Local-Agent-v0.3.2.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "Sentinel-Local-Agent-v0.3.2.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "Sentinel-Local-Agent-v0.3.2.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SENTINEL-LOCAL-AGENT-V0.3.2.EXE.LOG" "Sentinel-Local-Agent-v0.3.2.exe" trying to access non-existent file "C:\Sentinel-Local-Agent-v0.3.2.exe.config" "Sentinel-Local-Agent-v0.3.2.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\SENTINEL-LO1C645E79#" "Sentinel-Local-Agent-v0.3.2.exe" trying to access non-existent file "C:\SENTINEL-LOCAL-AGENT-V0.3.2.INI" "Sentinel-Local-Agent-v0.3.2.exe" trying to access non-existent file "C:\Sentinel-Local-Agent-v0.3.2.INI" "Sentinel-Local-Agent-v0.3.2.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "Sentinel-Local-Agent-v0.3.2.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\SYSTEM.WEB.28B9EF5A#" "Sentinel-Local-Agent-v0.3.2.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\SYSTEM.WEB.EXTENSIONS.INI" "Sentinel-Local-Agent-v0.3.2.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.INI" "Sentinel-Local-Agent-v0.3.2.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}" "Sentinel-Local-Agent-v0.3.2.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}"37:T685,Potential IP "127.0.0.1" found in string ": http://127.0.0.1:$Port" -ForegroundColor Cyan Write-Host "" "127.0.0.1:17831" Foreground="#52606B" FontFamily="Segoe UI" FontSize="8" FontWeight="Bold" Margin="0,4,0,0" />