24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 50:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T48c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 73c38b0fbae1… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 73c38b0fbae1…. Malware family: Trojan.Generic. Threat score 100/100. 11/25 AV engines flagged this file. 7 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/73c38b0fbae15628d39515ffbbe8d71aa8b5ff7c6891ec5f8c1f2fc6a1f0210c","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","73c38b0fbae15628d39515ffbbe8d71aa8b5ff7c6891ec5f8c1f2fc6a1f0210c"],"about":{"@type":"SoftwareApplication","name":"RFQ 002902999.exe","applicationCategory":["peexe","executable"],"identifier":"73c38b0fbae15628d39515ffbbe8d71aa8b5ff7c6891ec5f8c1f2fc6a1f0210c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":11,"total":25},"behavioralIndicators":{"malicious":7,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T2b8a,Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "MulDiv"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "SetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowEnabled"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetPathFromIDListW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowExW"; Source: "sample.bin"), Found reference to API (Indicator: "DefWindowProcW"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSize"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "sample.bin"), Found reference to API (Indicator: "SystemParametersInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcatW"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextW"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFolderPathW"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SetClipboardData"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueW"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteObject"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumValueW"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowVisible"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "wsprintfA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "wsprintfW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathW"; Source: "sample.bin"), Found reference to API (Indicator: "EnableMenuItem"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "CompareFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "LoadCursorW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "sample.bin"), Found reference to API (Indicator: "CloseClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindow"; Source: "sample.bin"), Found reference to API (Indicator: "RegisterClassW"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "AppendMenuW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenW"; Source: "sample.bin"), Found reference to API (Indicator: "SHFileOperationW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "CoTaskMemFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetShortPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSysColor"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileStringW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMenu"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SelectObject"; Source: "sample.bin"), Found reference to API (Indicator: "InvalidateRect"; Source: "sample.bin"), Found reference to API (Indicator: "SHBrowseForFolderW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpW"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "OleInitialize"; Source: "sample.bin"), Found reference to API (Indicator: "WritePrivateProfileStringW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadImageW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetClientRect"; Source: "sample.bin"), Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExW"; Source: "sample.bin"), Found reference to API (Indicator: "CopyFileW"; Source: "sample.bin"), Found reference to API (Indicator: "PostQuitMessage"; Source: "sample.bin"), Found reference to API (Indicator: "BeginPaint"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueW"; Source: "sample.bin"), Found reference to API (Indicator: "CharPrevW"; Source: "sample.bin"), Found reference to API (Indicator: "SetCursor"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpiA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpiW"; Source: "sample.bin"), Found reference to API (Indicator: "FillRect"; Source: "sample.bin"), Found reference to API (Indicator: "GetDeviceCaps"; Source: "sample.bin"), Found reference to API (Indicator: "GetFullPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpynW"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateInstance"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowTextW"; Source: "sample.bin"), Found reference to API (Indicator: "OleUninitialize"; Source: "sample.bin"), Found reference to API (Indicator: "EnableWindow"; Source: "sample.bin"), Found reference to API (Indicator: "EmptyClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "SetErrorMode"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFileInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "SearchPathW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineW"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessW"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetSpecialFolderLocation"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "SetTimer"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "TrackPopupMenu"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileW"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "ExitWindowsEx"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpyA"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpyW"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileSecurityW"; Source: "sample.bin"), Found reference to API (Indicator: "ScreenToClient"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFontIndirectW"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceW"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "CreatePopupMenu"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "OpenClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin")26:T6f2,"powershell.exe" called "CryptImportKey" with parameters {"hProv": "217440" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "c8b01e00"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "217440" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "48b41e00"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "217440" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "48b61e00"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "217440" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "c8b51e00"}27:T3b78,"RFQ002902999.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002496) "RFQ002902999.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000a10040f6120095e1e87644301700feffffffff2bec769a2aec764411ab7100000000000000004cf412002c32d476e8f41200c83ab0755cf51200d58ca87598f512002cf5120042a4a675a802b0756cf51200d2f4a675080000006ef5a67544f5a675f3f45f8402000000341aa871000013005b51a87102000000000000004411ab71108a29004411ab7100000000108a2900b0f51200086dec761881f47601000000000000000000a871341aa871000013005b51a871042da100002da10080f51200c0f5120040f6120091e1aa71f942eaf5c4f51200c89fec764411ab7100000000 (UID: 00000000-00002496) "RFQ002902999.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600f2db5f8414dc12006d82dd762c5e2a0004010000 (UID: 00000000-00002496) "RFQ002902999.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000780065000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff2bec7694eae976d8ebe576ac0126000000260000000000000000001100a700a0000000000000000000000000000000000000001200a200a00000000000000000000000406d260000000000200000000000000000000000 (UID: 00000000-00002496) "RFQ002902999.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000008f21200308069680000000000000200ccf11200ccf11200ccf112000200000002000000010042000500000000000000000000000000000030f312005477ec760cf212000000000014000000bf77ec760000636800000000000080008cf21200f0006368000000000000000000000000000000000000000000000000000000000000000012001400e4f31200b4f312000100000000000000ff2bec7694dee97600000000940126000000260000000000000000001e00420019000000000000000000000000000000000020001f000e00190000000cf3120020000000406d2600 (UID: 00000000-00002496) "RFQ002902999.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002b0098392b0093392b0000000000000000000000260000000001b4da36020000000018e8360295e1e8767c3e1700feffffff435cec765059ec76aa000000b800000092392b0090392b003cdc360274e03602000000000000000000000000000000000000000000000000c00d0000000026001c5ceb7660d8ef74ffffffff17000000ecdb36022400000003000000dce0360208e6360274e036028600000018dc360296edec76ba392b00a06ac274860000003cdc360274e036020000000086008800a06ac2743cdc3602916cc274ba392b00a06ac274a06ac274ace0360202020000 (UID: 00000000-00002496) "RFQ002902999.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002496) "nsB2EC.tmp" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004044) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003168) "powershell.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003168) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000d000000000052d00d000500000081d0df7508d00d000cd00d0000000000c0a21d009c50eb76e26bef742001000020010000d8cf0d00b0eab57520010000f8cf0d00b4d40d005ecbdd752001000000000000005ddb7510d70d000e5ddb75a8d20d00dcaadf75010000000000000072000000ffffffffffffffff30d00d0078020000000000002500000030d00d007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360079e2058588d00d006d82dd7624ac1d0004010000 (UID: 00000000-00003168) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000330032005c00570069006e0064006f007700730050006f007700650072005300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e0065007800650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff2bec76998ef676d8ebe576ac0118000000180000000000000000000300ed00fb020000000000000000000000000000000000000400e800fb0200000000000000000000a070180000000000200000000000000000000000 (UID: 00000000-00003168) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000001e0088e41d00c89f1b0040871b0018000000000018000080000020e41d00f8cf0d000200000000f61b000000000001000008000000000000180028e41d0081271700feffffff70cf0d003f08b6750200000000f61b00000000000100001888fbb57560cf0d00c81cdf7536d10d0095fbb57594d00d0000f61b000000000000000000000000001cd00d00000018007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600adfd0585dccf0d006d82dd7624ac1d0004010000 (UID: 00000000-00003168) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000dd76010000000080000000000000000000003cc80d002333dd7670c80d00008000000080000070c80d003733dd760000000076c80d002dfa058558c80d006732dd7650cd0d0004370e857cca0d00135fdb7570c80d0062cd0d0000000000b8d10d00d0061e0084cf0d00205fdb7543003a005c0055007300650072007300000048004100500055004200570053007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600c5fa0585f4c80d006d82dd76d4001e0004010000 (UID: 00000000-00003168) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000d00000000002ebb0d000900000081d0df75a8ba0d00acba0d00000000000c3b1e009c50eb76e26bef745c0100005c01000078ba0d00b0eab5755c01000098ba0d0054bf0d005ecbdd755c01000000000000005ddb75b0c10d000e5ddb7548bd0d00dcaadf7501000000000000007a000000ffffffffffffffffd0ba0d00780200000000000025000000d0ba0d007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036001989058528bb0d006d82dd76ac4a1e0004010000 (UID: 00000000-00003168) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000ec765059ec767a00000088000000c2331e00c0331e000000000058d111760800000000000000e4b90d00e738ec76ec38ec764d8cf676000000008228ec76340000c0bcb90d001664ec76f8e10d0095e1e876d92d1700fefffffff4b90d00bd6bef74020000008228ec7670ba0d00f799ef740300000000000000880000000000000058ba0d00c976ef74000018007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036004d8805857cba0d006d82dd76ac4a1e0004010000 (UID: 00000000-00003168) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000dd7601000000008000000000000000000000dcb20d002333dd7610b30d00008000000080000010b30d003733dd760000000016b30d00cd800585f8b20d006732dd76f0b70d00a44d0e851cb50d00135fdb7510b30d0046b80d000000000058bc0d00b0ac1b0024ba0d00205fdb7543003a005c00550073006500720073005c0048004100500055004200570053007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036006581058594b30d006d82dd763c551e0004010000 (UID: 00000000-00003168) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000d0000000000a2b00d000a00000081d0df75f8af0d00fcaf0d0000000000aa381e009c50eb76e26bef745c0100005c010000c8af0d00b0eab5755c010000e8af0d00a4b40d005ecbdd755c01000000000000005ddb7500b70d000e5ddb7598b20d00dcaadf7501000000000000007c000000ffffffffffffffff20b00d0078020000000000002500000020b00d007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036004982058578b00d006d82dd7664571e0004010000 (UID: 00000000-00003168) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000001e0001000000ffffffff0200000008000000d0521e00d0521e00cb521e00000000000200000000f61b00000000000100000800000000f8e10d0095e1e87681271700feffffff60af0d003f08b6750200000000f61b00000000000100001888fbb57550af0d00c81cdf7526b10d0095fbb57584b00d0000f61b000000000000000000000000000cb00d00000018007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600bd9d0585ccaf0d006d82dd766c601e0004010000 (UID: 00000000-00003168) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000180038121b00f8e10d0095e1e8761c00fe004b010000e063ec761664ec7600000000880a1b000100000030121b00e4c30d000029ec7600000000d0c90d000000000030121b002cc40d001c76ef7400001800000000003276ef74e6f40685d0c90d000000000000000000a04a1e00000000001cc40d00f8c30d00a44a1e00f8e10d00bd06f174f246e4f1feffffff7b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360061f6058590c40d006d82dd76d4001e0004010000 (UID: 00000000-00003168) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000d000000000052d00d000500000081d0df7508d00d000cd00d000000000020aa1d009c50eb76e26bef748801000088010000d8cf0d00b0eab57588010000f8cf0d00b4d40d005ecbdd758801000000000000005ddb7510d70d000e5ddb75a8d20d00dcaadf75010000000000000072000000ffffffffffffffff30d00d0078020000000000002500000030d00d007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360079e2058588d00d006d82dd7664361f0004010000 (UID: 00000000-00003168) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000ffff2d000d0007000000620bdd7500000000a0701800000000005000000064b61d000200000000f61b000000000001000008d0601e00c8741800380bdd75bcce0d000200000070cf0d003f08b6750200000000f61b00000000000100001888fbb57560cf0d00c81cdf7536d10d0095fbb57594d00d0000f61b000000000000000000000000001cd00d00000018007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600adfd0585dccf0d006d82dd7664361f0004010000 (UID: 00000000-00003168) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000dd76010000000080000000000000000000003cc80d002333dd7670c80d00008000000080000070c80d003733dd760000000076c80d002dfa058558c80d006732dd7650cd0d0004370e857cca0d00135fdb7570c80d0062cd0d0000000000b8d10d0088821e0084cf0d00205fdb7543003a005c0055007300650072007300000048004100500055004200570053007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600c5fa0585f4c80d006d82dd769cf11e0004010000 (UID: 00000000-00003168) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000d00000000002ebb0d000900000081d0df75a8ba0d00acba0d0000000000cc411e009c50eb76e26bef74880100008801000078ba0d00b0eab5758801000098ba0d0054bf0d005ecbdd758801000000000000005ddb75b0c10d000e5ddb7548bd0d00dcaadf7501000000000000007a000000ffffffffffffffffd0ba0d00780200000000000025000000d0ba0d007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036001989058528bb0d006d82dd763c721f0004010000 (UID: 00000000-00003168)28:T8de,"RFQ002902999.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebe576e8392a0000f0fd7f9a5ced7600e0fd7f80c7120044f0fd7f00000000400000003f0000001e00000000f0fd7f74c71200c15ced766082f4761e00000000f0fd7f9a5ced7600e0fd7f98c712005789ec768083f4761317f074d8ebe576 (UID: 00000000-00002496) "RFQ002902999.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000000000000000000024f4120002000000000000001000000064f3120080f31200c976ef740000260000001400da76ef741c2e4f84000000000000636801000000935ced7600000000000000000000000048f312000100000018f61200bd06f1747cabb2f000000000bd146368e04e2900 (UID: 00000000-00002496) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebe57620e11d0000f0fd7f9a5ced7600e0fd7ff0bb0d0044f0fd7f00000000400000003f0000001e00000000f0fd7fe4bb0d00c15ced766082f4761e00000000f0fd7f9a5ced7600e0fd7f08bc0d005789ec768083f4761317f074d8ebe576 (UID: 00000000-00003168) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b005c00760032002e0030002e00350030003700320037005c006d00730063006f00720077006b0073002e0064006c006c002e0032002e004d0061006e00690066006500730074000000 (UID: 00000000-00003168) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000636d596800000c02000000006c6d59688e570c8ad8d73e6594eb0d0090eb0d0000000000000000000000000000000000d8d73e65e8ea0d000000000058eb0d0094eb0d0028eb0d00ff235968c83b626868eb0d0031175968080000001c5ceb7614a1ec76ffffffff2400000050eb0d00 (UID: 00000000-00003168) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003168)29:T63f,"RFQ002902999.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00002496) "RFQ002902999.exe" called "CreateDirectoryW" with parameter %TEMP%\ (UID: 00000000-00002496) "RFQ002902999.exe" called "CreateDirectoryW" with parameter C:\Users (UID: 00000000-00002496) "RFQ002902999.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00002496) "RFQ002902999.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData (UID: 00000000-00002496) "RFQ002902999.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00002496) "RFQ002902999.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00002496) "RFQ002902999.exe" called "CreateDirectoryW" with parameter %TEMP%\Bestridelsers (UID: 00000000-00002496) "RFQ002902999.exe" called "CreateDirectoryW" with parameter %TEMP%\Bestridelsers\Coordinated (UID: 00000000-00002496) "RFQ002902999.exe" called "CreateDirectoryW" with parameter %TEMP%\Bestridelsers\Coordinated\Forvaringernes (UID: 00000000-00002496) "RFQ002902999.exe" called "CreateDirectoryW" with parameter %TEMP%\Bestridelsers\Coordinated\Forvaringernes\Udrejsetilladelse (UID: 00000000-00002496) "RFQ002902999.exe" called "CreateDirectoryW" with parameter %TEMP%\Bestridelsers\Coordinated\Forvaringernes\Udrejsetilladelse\Eleusine (UID: 00000000-00002496) "RFQ002902999.exe" called "CreateDirectoryW" with parameter %TEMP%\Bestridelsers\Coordinated\Forvaringernes\Udrejsetilladelse\Eleusine\Sankthansdagenes199 (UID: 00000000-00002496)2a:T2e94,"RFQ002902999.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002496) "RFQ002902999.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002496) "RFQ002902999.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002496) "RFQ002902999.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002496) "RFQ002902999.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002496) "RFQ002902999.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00002496) "RFQ002902999.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PROPSYS.dll (UID: 00000000-00002496) "RFQ002902999.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DWMAPI.dll (UID: 00000000-00002496) "RFQ002902999.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPTBASE.dll (UID: 00000000-00002496) "RFQ002902999.exe" called "LoadLibrary" with a parameter OLEACCRC.DLL (UID: 00000000-00002496) "RFQ002902999.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLEACC.dll (UID: 00000000-00002496) "RFQ002902999.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CLBCATQ.dll (UID: 00000000-00002496) "RFQ002902999.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.dll (UID: 00000000-00002496) "RFQ002902999.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHFOLDER.dll (UID: 00000000-00002496) "RFQ002902999.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002496) "RFQ002902999.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002496) "RFQ002902999.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002496) "RFQ002902999.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00002496) "RFQ002902999.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RichEd20.dll (UID: 00000000-00002496) "RFQ002902999.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00002496) "RFQ002902999.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00002496) "RFQ002902999.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00002496) "RFQ002902999.exe" called "LoadLibrary" with a parameter %TEMP%\nssB2CB.tmp\nsExec.dll (UID: 00000000-00002496) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System\ad92dab7f418877d6a1e0358ce35658a\System.ni.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\8229f0505633d4bcef019b9d4fab9f18\Microsoft.PowerShell.ConsoleH (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management.A#\84c47b5a5813a5f040aee9715a0ff7c0\System.Management.Automation. (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Core\bd9ff1a4363781a57e8f7392f230a203\System.Core.ni.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\49cae79ac18bad142e1ab5a46a8ac306\Microsoft.PowerShell.Commands (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\d6acc39f6c1ea42d8b3150db6184a969\System.Configuration.Install. (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\7bf5729401cff7ea7898124e9818ed20\Microsoft.WSMan.Management.ni (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Transactions\fec007ea17ac8956cc5d6d4074dada6a\System.Transactions.ni.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\f1831ce4588265a3f72e0a581ba58f2a\Microsoft.PowerShell.Commands (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\344e681515d07b93a4f1383f0d625e1e\Microsoft.PowerShell.Commands (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\573750f17b5b8316f04a10956fdd1d97\Microsoft.PowerShell.Security (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\culture.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml\77c1dc46ea139bf5e1eaa9b87ef03c7a\System.Xml.ni.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management\00c2b464e52d4e82c04d61592a12a89d\System.Management.ni.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\237ed1739105c1bebe48d41905fdb3ee\System.DirectoryServices.ni.d (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter shfolder.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data\511c39d1efa06d262a6b2f47e2726c73\System.Data.ni.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll (UID: 00000000-00003168) "powershell.exe" called "LoadLibrary" with a parameter netutils.dll (UID: 00000000-00003168)2b:Ta058,"RFQ002902999.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter NotifyWinEvent (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter ExecToStack (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002496) "RFQ002902999.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00002496) "nsB2EC.tmp" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004044) "nsB2EC.tmp" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004044) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadBSTR (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter IsCharAlphaW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CharPrevW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetNetResourceFromLocalPathW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter NetShareEnum (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CscNetApiGetInterface (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter SLGetWindowsInformationDWORD (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter PathRemoveFileSpecW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter _set_error_mode (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter ?set_terminate@@YAP6AXXZP6AXXZ@Z (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter _get_terminate (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter SetLoadedByMscoree (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetCLRFunction (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetTraceLoggerHandle (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetTraceEnableLevel (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetTraceEnableFlags (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter TraceEvent (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter IEE (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter IEE_RetAddr (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetStartupFlags (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetStartupFlags_RetAddr (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetHostConfigurationFile (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetHostConfigurationFile_RetAddr (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetCORVersion_RetAddr (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetCORVersion (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory_RetAddr (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter RtlUnwind (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter RemoveVectoredContinueHandler (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetWriteWatch (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter ResetWriteWatch (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CreateMemoryResourceNotification (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter QueryMemoryResourceNotification (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetVersionEx (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter lstrlen (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter lstrlenW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter ND_RI2 (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter ND_RI2_RetAddr (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter lstrcpy (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter lstrcpyW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CryptGenKey (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CryptSignHashA (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CryptGetUserKey (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CryptEnumProvidersA (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryShim_RetAddr (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryShim (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter ConvertLangIdToCultureName (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter ND_RI4 (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter ND_RI4_RetAddr (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter WinSqmIsOptedIn (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValue (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectory (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandleW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCPW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObject_RetAddr (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00003168) "powershell.exe" called "GetProcAddress" with a parameter NetApiBufferFree (UID: 00000000-00003168)2c:T571,"RFQ002902999.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "RFQ002902999.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135]2d:T24ea,"RFQ002902999.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70520000 "RFQ002902999.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "RFQ002902999.exe" loaded module "KERNEL32" at base 75b10000 "RFQ002902999.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "RFQ002902999.exe" loaded module "ADVAPI32.DLL" at base 75690000 "RFQ002902999.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73a80000 "RFQ002902999.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 739e0000 "RFQ002902999.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTBASE.DLL" at base 74c70000 "RFQ002902999.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 71a80000 "RFQ002902999.exe" loaded module "%WINDIR%\SYSTEM32\CLBCATQ.DLL" at base 75180000 "RFQ002902999.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 74210000 "RFQ002902999.exe" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 714f0000 "RFQ002902999.exe" loaded module "CRYPTBASE.DLL" at base 74c70000 "RFQ002902999.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73850000 "RFQ002902999.exe" loaded module "OLE32.DLL" at base 75bf0000 "RFQ002902999.exe" loaded module "KERNEL32.DLL" at base 75b10000 "RFQ002902999.exe" loaded module "COMCTL32.DLL" at base 73ca0000 "RFQ002902999.exe" loaded module "OLEAUT32.DLL" at base 76a80000 "RFQ002902999.exe" loaded module "SETUPAPI.DLL" at base 754f0000 "RFQ002902999.exe" loaded module "RPCRT4.DLL" at base 76d10000 "RFQ002902999.exe" loaded module "CLBCATQ.DLL" at base 75180000 "RFQ002902999.exe" loaded module "NTMARTA.DLL" at base 73c70000 "RFQ002902999.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76b20000 "RFQ002902999.exe" loaded module "PROFAPI.DLL" at base 74d90000 "RFQ002902999.exe" loaded module "%WINDIR%\SYSTEM32\RICHED20.DLL" at base 68630000 "RFQ002902999.exe" loaded module "DWMAPI.DLL" at base 739e0000 "RFQ002902999.exe" loaded module "COMCTL32.DLL" at base 71510000 "RFQ002902999.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 75bf0000 "RFQ002902999.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 769b0000 "RFQ002902999.exe" loaded module "%TEMP%\NSSB2CB.TMP\NSEXEC.DLL" at base 10000000 "RFQ002902999.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74c20000 "nsB2EC.tmp" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74c20000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70520000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "powershell.exe" loaded module "KERNEL32" at base 75b10000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "powershell.exe" loaded module "ADVAPI32.DLL" at base 75690000 "powershell.exe" loaded module "KERNEL32.DLL" at base 75b10000 "powershell.exe" loaded module "SHELL32.DLL" at base 75d50000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 76a80000 "powershell.exe" loaded module "OLE32.DLL" at base 75bf0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75b10000 "powershell.exe" loaded module "SETUPAPI.DLL" at base 754f0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 76d10000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73a80000 "powershell.exe" loaded module "NTMARTA.DLL" at base 73c70000 "powershell.exe" loaded module "APPHELP.DLL" at base 74c20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6dd80000 "powershell.exe" loaded module "PROPSYS.DLL" at base 73a80000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75d50000 "powershell.exe" loaded module "LINKINFO.DLL" at base 6dc60000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76b20000 "powershell.exe" loaded module "PROFAPI.DLL" at base 74d90000 "powershell.exe" loaded module "USER32.DLL" at base 750b0000 "powershell.exe" loaded module "NTSHRUI.DLL" at base 72480000 "powershell.exe" loaded module "SRVCLI.DLL" at base 74990000 "powershell.exe" loaded module "CSCAPI.DLL" at base 6f640000 "powershell.exe" loaded module "SLC.DLL" at base 73130000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 76dc0000 "powershell.exe" loaded module "CRYPTSP.DLL" at base 74780000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74510000 "powershell.exe" loaded module "CRYPTBASE.DLL" at base 74c70000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 71bd0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "VERSION.DLL" at base 74210000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORWKS.DLL" at base 64e80000 "powershell.exe" loaded module "MSCOREE.DLL" at base 71c60000 "powershell.exe" loaded module "NTDLL" at base 76e70000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 71c60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\9F895C66454577EFF9C77442D0C84F71\MSCORLIB.NI.DLL" at base 64380000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\OLE32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\AD92DAB7F418877D6A1E0358CE35658A\SYSTEM.NI.DLL" at base 63bd0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\8229F0505633D4BCEF019B9D4FAB9F18\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 63b40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.MANAGEMENT.A#\84C47B5A5813A5F040AEE9715A0FF7C0\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 62fd0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "PSAPI.DLL" at base 75a50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 76e70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CORE\BD9FF1A4363781A57E8F7392F230A203\SYSTEM.CORE.NI.DLL" at base 62d90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\49CAE79AC18BAD142E1AB5A46A8AC306\MICROSOFT.POWERSHELL.COMMANDS.DIAGNOSTICS.NI.DLL" at base 6af90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATIO#\D6ACC39F6C1EA42D8B3150DB6184A969\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 6d660000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.WSMAN.MAN#\7BF5729401CFF7EA7898124E9818ED20\MICROSOFT.WSMAN.MANAGEMENT.NI.DLL" at base 62d00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.TRANSACTIONS\FEC007EA17AC8956CC5D6D4074DADA6A\SYSTEM.TRANSACTIONS.NI.DLL" at base 62c60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\2.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 684d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\F1831CE4588265A3F72E0A581BA58F2A\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 62ac0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\344E681515D07B93A4F1383F0D625E1E\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 629f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\573750F17B5B8316F04A10956FDD1D97\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 6c5b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CULTURE.DLL" at base 711b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\77C1DC46EA139BF5E1EAA9B87EF03C7A\SYSTEM.XML.NI.DLL" at base 624b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.MANAGEMENT\00C2B464E52D4E82C04D61592A12A89D\SYSTEM.MANAGEMENT.NI.DLL" at base 623a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DIRECTORYSER#\237ED1739105C1BEBE48D41905FDB3EE\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 62280000 "powershell.exe" loaded module "SHFOLDER.DLL" at base 714f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 74ab0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 74c00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DATA\511C39D1EFA06D262A6B2F47E2726C73\SYSTEM.DATA.NI.DLL" at base 61c20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\SYSTEM.DATA\2.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 61940000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORJIT.DLL" at base 618e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DIASYMREADER.DLL" at base 61850000 "powershell.exe" loaded module "NETUTILS.DLL" at base 739d00002e:T746,"RFQ002902999.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "RFQ002902999.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "powershell.exe" touched "Custom Destination List" (Path: "HKCU\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}") "powershell.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}") "powershell.exe" touched "Start Menu Pin" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{A2A9545D-A0C2-42B4-9708-A0B2BADD77C8}") "powershell.exe" touched "Taskband Pin" (Path: "HKCU\CLSID\{90AA3A4E-1CBA-4233-B8BB-535773D48449}\TREATAS") "powershell.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "Internet Shortcut" (Path: "HKCU\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "User Pinned" (Path: "HKCU\CLSID\{1F3427C8-5C10-4210-AA03-2EE45287D668}\SHELLFOLDER") "powershell.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{F3364BA0-65B9-11CE-A9BA-00AA004AE837}\INPROCSERVER32") "powershell.exe" touched "User Assist" (Path: "HKCU\CLSID\{DD313E04-FEFF-11D1-8ECD-0000F87A470C}\TREATAS") "powershell.exe" touched "Shared Task Scheduler" (Path: "HKCU\CLSID\{603D3801-BD81-11D0-A3A5-00C04FD706EC}\TREATAS") "powershell.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "powershell.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32")2f:T4b3,"RFQ 002902999.exe" file has an entrypoint instructions - "sub esp, 0x2d4,push ebx,push esi,push edi,push 0x20,pop edi,xor ebx, ebx,push 0x8001,mov dword ptr [esp + 0x14], ebx,mov dword ptr [esp + 0x10], 0x40a2e0,mov dword ptr [esp + 0x1c], ebx,call dword ptr [0x4080b0],call dword ptr [0x4080ac],cmp ax, 6,je 0x4032c3,push ebx,call 0x406407,cmp eax, ebx,je 0x4032c3,push 0xc00,call eax,mov esi, 0x4082b8,push esi,call 0x406397,push esi,call dword ptr [0x40815c],lea esi, [esi + eax + 1],cmp byte ptr [esi], 0,jne 0x4032c8,push ebp,push 9," "nsExec.dll" file has an entrypoint instructions - "mov eax, dword ptr [esp + 4],mov dword ptr [0x10003cbc], eax,xor eax, eax,inc eax,ret 0xc,push ebp,mov ebp, esp,push ecx,push esi,push 0x10003014,push 0x10003000,call dword ptr [0x1000200c],push eax,call dword ptr [0x10002050],mov esi, eax,test esi, esi,je 0x100010ce,lea eax, [ebp - 4],push eax,call dword ptr [0x10002060],push eax,call esi,test eax, eax,je 0x100010ce,mov eax, dword ptr [ebp - 4],jmp 0x100010d0,xor eax, eax,pop esi,leave ,ret ,push ebp,mov ebp, esp,push esi,mov esi, dword ptr [ebp + 0x10],push edi,xor edi, edi,push dword ptr [ebp + 8],mov word ptr [esi], di,call dword ptr [0x10002014],"30:T1a59,Observed system executable string:"/C:\ PROGRA~2Vyd* MICROS~1VQt* WindowsSTARTM~1ProgramsVyd*ACCESS~1WINDOW~1WINDOW~1.LNKC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk1SPS1SPSdet-tjeahcdvuoi/C:\ PROGRA~2Vyd* MICROS~1VQt* WindowsSTARTM~1ProgramsVyd*ACCESS~1WINDOW~1WINDOW~1.LNKC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk1SPS1SPSdet-tjeahcdvuoi/C:\WindowsSystem32WINDOW~1v1.0powershell_ise.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exe1SPS1SPSdet-tjeahcdvuoi+7C:+7C:/C:\Windowshh.exeC:\Windows\hh.exe%systemroot%\hh.exe1SPS1SPSdet-tjeahcdvuoi" [Source: ZGOTQ5XQWOO240PLZIHM.temp] Observed system executable string:"%WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe" [Source: 00000000-00003168-00000C28-4480557148] Observed system executable string:"%WINDIR%\system32\powershell.exe" [Source: 00000000-00003168-00000C28-13112061418] Observed system executable string:"%WINDIR%\system32\powershell.exe.ps1" [Source: 00000000-00003168-00000C28-13113122808] Observed system executable string:"%WINDIR%\system32\powershell.exe.psm1" [Source: 00000000-00003168-00000C28-13114174758] Observed system executable string:"%WINDIR%\system32\powershell.exe.psd1" [Source: 00000000-00003168-00000C28-13115231898] Observed system executable string:"%WINDIR%\system32\powershell.exe.COM" [Source: 00000000-00003168-00000C28-13116301128] Observed system executable string:"%WINDIR%\system32\powershell.exe.EXE" [Source: 00000000-00003168-00000C28-13117356528] Observed system executable string:"%WINDIR%\system32\powershell.exe.BAT" [Source: 00000000-00003168-00000C28-13118409834] Observed system executable string:"%WINDIR%\system32\powershell.exe.CMD" [Source: 00000000-00003168-00000C28-13119458842] Observed system executable string:"%WINDIR%\system32\powershell.exe.VBS" [Source: 00000000-00003168-00000C28-13120889006] Observed system executable string:"%WINDIR%\system32\powershell.exe.VBE" [Source: 00000000-00003168-00000C28-13121951488] Observed system executable string:"%WINDIR%\system32\powershell.exe.JS" [Source: 00000000-00003168-00000C28-13122997322] Observed system executable string:"%WINDIR%\system32\powershell.exe.JSE" [Source: 00000000-00003168-00000C28-13124052362] Observed system executable string:"%WINDIR%\system32\powershell.exe.WSF" [Source: 00000000-00003168-00000C28-13125106364] Observed system executable string:"%WINDIR%\system32\powershell.exe.WSH" [Source: 00000000-00003168-00000C28-13126177038] Observed system executable string:"%WINDIR%\system32\powershell.exe.MSC" [Source: 00000000-00003168-00000C28-13127233620] Observed system executable string:"%WINDIR%\powershell.exe" [Source: 00000000-00003168-00000C28-13128284862] Observed system executable string:"%WINDIR%\powershell.exe.ps1" [Source: 00000000-00003168-00000C28-13129314714] Observed system executable string:"%WINDIR%\powershell.exe.psm1" [Source: 00000000-00003168-00000C28-13197542310] Observed system executable string:"%WINDIR%\powershell.exe.psd1" [Source: 00000000-00003168-00000C28-13198609834] Observed system executable string:"%WINDIR%\powershell.exe.COM" [Source: 00000000-00003168-00000C28-13199657140] Observed system executable string:"%WINDIR%\powershell.exe.EXE" [Source: 00000000-00003168-00000C28-13200700860] Observed system executable string:"%WINDIR%\powershell.exe.BAT" [Source: 00000000-00003168-00000C28-13202116074] Observed system executable string:"%WINDIR%\powershell.exe.CMD" [Source: 00000000-00003168-00000C28-13203175262] Observed system executable string:"%WINDIR%\powershell.exe.VBS" [Source: 00000000-00003168-00000C28-13204218836] Observed system executable string:"%WINDIR%\powershell.exe.VBE" [Source: 00000000-00003168-00000C28-13205347378] Observed system executable string:"%WINDIR%\powershell.exe.JS" [Source: 00000000-00003168-00000C28-13206388004] Observed system executable string:"%WINDIR%\powershell.exe.JSE" [Source: 00000000-00003168-00000C28-13207451720] Observed system executable string:"%WINDIR%\powershell.exe.WSF" [Source: 00000000-00003168-00000C28-13208489790] Observed system executable string:"%WINDIR%\powershell.exe.WSH" [Source: 00000000-00003168-00000C28-13209531346] Observed system executable string:"%WINDIR%\powershell.exe.MSC" [Source: 00000000-00003168-00000C28-13210566104] Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe" [Source: 00000000-00003168-00000C28-13211617244] Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.ps1" [Source: 00000000-00003168-00000C28-13212670290] Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.psm1" [Source: 00000000-00003168-00000C28-13213733490] Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.psd1" [Source: 00000000-00003168-00000C28-13214816466] Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.COM" [Source: 00000000-00003168-00000C28-13216268786] Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.EXE" [Source: 00000000-00003168-00000C28-13217340012] Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.BAT" [Source: 00000000-00003168-00000C28-13218390924] Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.CMD" [Source: 00000000-00003168-00000C28-13219447686] Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.VBS" [Source: 00000000-00003168-00000C28-13220511180] Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.VBE" [Source: 00000000-00003168-00000C28-13221563460] Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.JS" [Source: 00000000-00003168-00000C28-13222637482] Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.JSE" [Source: 00000000-00003168-00000C28-13223694756] Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.WSF" [Source: 00000000-00003168-00000C28-13224752636] Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.WSH" [Source: 00000000-00003168-00000C28-13225803152] Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.MSC" [Source: 00000000-00003168-00000C28-13226856880] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00003168-00000C28-13227927954]31:Tdaa,Observed system executable string:"%WINDIR%\system32\PROPSYS.dll" [Source: 00000000-00002496-00000C25-37478787] Observed system executable string:"%WINDIR%\system32\DWMAPI.dll" [Source: 00000000-00002496-00000C25-37491567] Observed system executable string:"%WINDIR%\system32\CRYPTBASE.dll" [Source: 00000000-00002496-00000C25-37504107] Observed system executable string:"%WINDIR%\system32\OLEACC.dll" [Source: 00000000-00002496-00000C25-37527941] Observed system executable string:"%WINDIR%\system32\CLBCATQ.dll" [Source: 00000000-00002496-00000C25-37539644] Observed system executable string:"%WINDIR%\system32\VERSION.dll" [Source: 00000000-00002496-00000C25-37556293] Observed system executable string:"%WINDIR%\system32\SHFOLDER.dll" [Source: 00000000-00002496-00000C25-37567389] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00002496-00000C25-37580562] Observed system executable string:"%WINDIR%\system32\RichEd20.dll" [Source: 00000000-00002496-00000C25-37935026] Observed system executable string:"%WINDIR%\system32\ole32.dll" [Source: 00000000-00002496-00000C25-38041746] Observed system executable string:"%WINDIR%\system32\MSCTF.dll" [Source: 00000000-00002496-00000C25-38075493] Observed system executable string:"%WINDIR%\system32\shell32.dll" [Source: 00000000-00003168-00000C25-40052665] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00003168-00000C25-41194703] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" [Source: 00000000-00003168-00000C25-41335277] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll" [Source: 00000000-00003168-00000C25-42003972] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll" [Source: 00000000-00003168-00000C25-42048253] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll" [Source: 00000000-00003168-00000C25-42126605] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System\ad92dab7f418877d6a1e0358ce35658a\System.ni.dll" [Source: 00000000-00003168-00000C25-42296295] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" [Source: 00000000-00003168-00000C25-42441430] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00003168-00000C25-42511613] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00003168-00000C25-42611012] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Core\bd9ff1a4363781a57e8f7392f230a203\System.Core.ni.dll" [Source: 00000000-00003168-00000C25-43133331] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Transactions\fec007ea17ac8956cc5d6d4074dada6a\System.Transactions.ni.dll" [Source: 00000000-00003168-00000C25-43238708] Observed system executable string:"%WINDIR%\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll" [Source: 00000000-00003168-00000C25-43282453] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\culture.dll" [Source: 00000000-00003168-00000C25-43432600]32:T4b0,"RFQ002902999.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\Bestridelsers\Coordinated\Forvaringernes\Udrejsetilladelse\Eleusine\Sankthansdagenes199\Dullardness.reg" "RFQ002902999.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\Bestridelsers\Coordinated\Forvaringernes\Udrejsetilladelse\Eleusine\Sankthansdagenes199\Rosario.New" "RFQ002902999.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\Bestridelsers\Coordinated\Forvaringernes\Udrejsetilladelse\Eleusine\Sankthansdagenes199\Penlightceller.cru" "RFQ002902999.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\Bestridelsers\Coordinated\Forvaringernes\Udrejsetilladelse\Eleusine\Sankthansdagenes199\argoternes.txt" "RFQ002902999.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\Bestridelsers\Coordinated\Stannel17\Uninterspersed\Autopotamic\columbae.occ" "RFQ002902999.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\Bestridelsers\Coordinated\Interessentselskabs\gallons.arv" "RFQ002902999.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\nssB2CB.tmp\nsExec.dll" "RFQ002902999.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\nssB2CB.tmp\nsB2EC.tmp"33:T5c3,"Dullardness.reg" has type "data"- Location: [%TEMP%\Bestridelsers\Coordinated\Forvaringernes\Udrejsetilladelse\Eleusine\Sankthansdagenes199\Dullardness.reg]- [targetUID: 00000000-00002496] "nsExec.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nssB2CB.tmp\nsExec.dll]- [targetUID: 00000000-00002496] "columbae.occ" has type "data"- Location: [%TEMP%\Bestridelsers\Coordinated\Stannel17\Uninterspersed\Autopotamic\columbae.occ]- [targetUID: 00000000-00002496] "gallons.arv" has type "data"- Location: [%TEMP%\Bestridelsers\Coordinated\Interessentselskabs\gallons.arv]- [targetUID: 00000000-00002496] "Rosario.New" has type "ASCII text with very long lines with no line terminators"- Location: [%TEMP%\Bestridelsers\Coordinated\Forvaringernes\Udrejsetilladelse\Eleusine\Sankthansdagenes199\Rosario.New]- [targetUID: 00000000-00003168] "Penlightceller.cru" has type "data"- Location: [%TEMP%\Bestridelsers\Coordinated\Forvaringernes\Udrejsetilladelse\Eleusine\Sankthansdagenes199\Penlightceller.cru]- [targetUID: 00000000-00002496] "argoternes.txt" has type "ASCII text with very long lines with CRLF line terminators"- Location: [%TEMP%\Bestridelsers\Coordinated\Forvaringernes\Udrejsetilladelse\Eleusine\Sankthansdagenes199\argoternes.txt]- [targetUID: 00000000-00002496] "nsB2EC.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nssB2CB.tmp\nsB2EC.tmp]- [targetUID: 00000000-00002496]34:T817,"RFQ002902999.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "RFQ002902999.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "RFQ002902999.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "RFQ002902999.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "RFQ002902999.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "RFQ002902999.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "RFQ002902999.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "RFQ002902999.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "RFQ002902999.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "RFQ002902999.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") "RFQ002902999.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: ""; Value: "") "RFQ002902999.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY"; Key: ""; Value: "") "RFQ002902999.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "RFQ002902999.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "RFQ002902999.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "RFQ002902999.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "")35:Tbe3,"RFQ002902999.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "RFQ002902999.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "RFQ002902999.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "RFQ002902999.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "RFQ002902999.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "RFQ002902999.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "RFQ002902999.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "RFQ002902999.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "RFQ002902999.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "RFQ002902999"; Value: "") "RFQ002902999.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "RFQ002902999.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "RFQ002902999.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "RFQ002902999.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "RFQ002902999.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "RFQ002902999.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "RFQ002902999.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "RFQ002902999.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "RFQ002902999.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "RFQ002902999.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "RFQ002902999.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "RFQ002902999.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "")36:T65d,"RFQ002902999.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "RFQ002902999.exe" trying to touch file "C:\RFQ002902999.exe.Local\" "RFQ002902999.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc" "RFQ002902999.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\COMCTL32.dll" "RFQ002902999.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "RFQ002902999.exe" trying to touch file "C:\Windows\system32\UXTHEME.dll" "RFQ002902999.exe" trying to touch file "C:\Windows\system32\USERENV.dll" "RFQ002902999.exe" trying to touch file "C:\Windows\system32\SETUPAPI.dll" "RFQ002902999.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "RFQ002902999.exe" trying to touch file "C:\FLTLIB.DLL" "RFQ002902999.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "RFQ002902999.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" "RFQ002902999.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "RFQ002902999.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "RFQ002902999.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "RFQ002902999.exe" trying to touch file "\FileSystem\Filters\FltMgrMsg" "RFQ002902999.exe" trying to touch file "C:\Windows\system32\APPHELP.dll" "RFQ002902999.exe" trying to touch file "C:\Windows\system32\PROPSYS.dll" "RFQ002902999.exe" trying to touch file "C:\Windows\system32\DWMAPI.dll"37:T8d4,"RFQ002902999.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "RFQ002902999.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "RFQ002902999.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "powershell.exe" touched file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.config" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch" "powershell.exe" touched file "C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb" "powershell.exe" touched file "C:\Windows\System.Management.Automation.pdb" "powershell.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "powershell.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZGOTQ5XQWOO240PLZIHM.temp" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFfbc6b.TMP" "powershell.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\ZGOTQ5XQWOO240PLZIHM.temp"38:T652,"RFQ002902999.exe" trying to access non-existent file "C:\FLTLIB.DLL" "RFQ002902999.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "RFQ002902999.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "RFQ002902999.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nssB2CB.tmp\nsExec.dll" "RFQ002902999.exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "RFQ002902999.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" "RFQ002902999.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" "RFQ002902999.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\nssB2CB.tmp\NSEXEC.DLL" "nsB2EC.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nssB2CB.tmp\powershell.exe" "nsB2EC.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Bestridelsers\Coordinated\Interessentselskabs\powershell.exe" "nsB2EC.tmp" trying to access non-existent file "C:\Windows\system32\powershell.exe" "nsB2EC.tmp" trying to access non-existent file "C:\Windows\system\powershell.exe" "nsB2EC.tmp" trying to access non-existent file "C:\Windows\powershell.exe" "nsB2EC.tmp" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath\powershell.exe" "nsB2EC.tmp" trying to access non-existent file "C:\Windows\System32\Wbem\powershell.exe"39:Tdd9,"RFQ002902999.exe" trying to access non-existent file "C:\RFQ002902999.exe.Local\" "RFQ002902999.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Bestridelsers\Coordinated\Forvaringernes\Udrejsetilladelse\Eleusine\Sankthansdagenes199\Dullardness.reg" "RFQ002902999.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Bestridelsers\Coordinated\Forvaringernes\Udrejsetilladelse\Eleusine\Sankthansdagenes199\Rosario.New" "RFQ002902999.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Bestridelsers\Coordinated\Forvaringernes\Udrejsetilladelse\Eleusine\Sankthansdagenes199\Penlightceller.cru" "RFQ002902999.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Bestridelsers\Coordinated\Forvaringernes\Udrejsetilladelse\Eleusine\Sankthansdagenes199\argoternes.txt" "RFQ002902999.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Bestridelsers\Coordinated\Stannel17\Uninterspersed\Autopotamic\columbae.occ" "RFQ002902999.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Bestridelsers\Coordinated\Interessentselskabs\gallons.arv" "RFQ002902999.exe" trying to access non-existent file "\Device\HarddiskVolume2\RFQ002902999.EXE.LOCAL" "RFQ002902999.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\Bestridelsers\Coordinated\Forvaringernes\Udrejsetilladelse\Eleusine\Sankthansdagenes199\DULLARDNESS.REG" "RFQ002902999.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\Bestridelsers\Coordinated\Forvaringernes\Udrejsetilladelse\Eleusine\Sankthansdagenes199\ROSARIO.NEW" "RFQ002902999.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\Bestridelsers\Coordinated\Forvaringernes\Udrejsetilladelse\Eleusine\Sankthansdagenes199\PENLIGHTCELLER.CRU" "RFQ002902999.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\Bestridelsers\Coordinated\Forvaringernes\Udrejsetilladelse\Eleusine\Sankthansdagenes199\ARGOTERNES.TXT" "RFQ002902999.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\Bestridelsers\Coordinated\Stannel17\Uninterspersed\Autopotamic\COLUMBAE.OCC" "RFQ002902999.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\Bestridelsers\Coordinated\Interessentselskabs\GALLONS.ARV" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\desktop.ini" "powershell.exe" trying to access non-existent file "C:\ProgramData\Microsoft\desktop.ini" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.config" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb"3a:T488,"RFQ002902999.exe" writes file "c:\users\%osuser%\appdata\local\temp\bestridelsers\coordinated\forvaringernes\udrejsetilladelse\eleusine\sankthansdagenes199\dullardness.reg" "RFQ002902999.exe" writes file "c:\users\%osuser%\appdata\local\temp\bestridelsers\coordinated\forvaringernes\udrejsetilladelse\eleusine\sankthansdagenes199\rosario.new" "RFQ002902999.exe" writes file "c:\users\%osuser%\appdata\local\temp\bestridelsers\coordinated\forvaringernes\udrejsetilladelse\eleusine\sankthansdagenes199\penlightceller.cru" "RFQ002902999.exe" writes file "c:\users\%osuser%\appdata\local\temp\bestridelsers\coordinated\forvaringernes\udrejsetilladelse\eleusine\sankthansdagenes199\argoternes.txt" "RFQ002902999.exe" writes file "c:\users\%osuser%\appdata\local\temp\bestridelsers\coordinated\stannel17\uninterspersed\autopotamic\columbae.occ" "RFQ002902999.exe" writes file "c:\users\%osuser%\appdata\local\temp\bestridelsers\coordinated\interessentselskabs\gallons.arv" "RFQ002902999.exe" writes file "c:\users\%osuser%\appdata\local\temp\nssb2cb.tmp\nsexec.dll" "RFQ002902999.exe" writes file "c:\users\%osuser%\appdata\local\temp\nssb2cb.tmp\nsb2ec.tmp"3b:T6e8,"RFQ002902999.exe" called "FindFirstFileW" with parameter %TEMP%\nssB2CB.tmp (UID: 00000000-00002496) "RFQ002902999.exe" called "FindFirstFileW" with parameter %TEMP%\nssB2CB.tmp\*.* (UID: 00000000-00002496) "RFQ002902999.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002496) "RFQ002902999.exe" called "FindNextFileW" with parameter nsB2EC.tmp (UID: 00000000-00002496) "RFQ002902999.exe" called "FindNextFileW" with parameter nsExec.dll (UID: 00000000-00002496) "RFQ002902999.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00002496) "RFQ002902999.exe" called "FindFirstFileW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00002496) "RFQ002902999.exe" called "FindFirstFileW" with parameter %USERPROFILE%\AppData (UID: 00000000-00002496) "RFQ002902999.exe" called "FindFirstFileW" with parameter C:\Users\%OSUSER% (UID: 00000000-00002496) "RFQ002902999.exe" called "FindFirstFileW" with parameter C:\Users (UID: 00000000-00002496) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe (UID: 00000000-00003168) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003168) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00003168) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003168) "powershell.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00003168) "powershell.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00003168) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00003168)3c:T6cd,Found string "powershell.exe -windowstyle hidden $derremc = Get-Content '%TEMP%\Bestridelsers\Coordinated\Forvaringernes\Udrejsetilladelse\Eleusine\Sankthansdagenes199\Rosario.New' ; powershell.exe "$derremc"" (Indicator: "Get-Content"; File: "nsB2EC.tmp") Found string "-windowstyle hidden $derremc = Get-Content '%TEMP%\Bestridelsers\Coordinated\Forvaringernes\Udrejsetilladelse\Eleusine\Sankthansdagenes199\Rosario.New' ; powershell.exe "$derremc"" (Indicator: "Get-Content"; File: "powershell.exe") file/memory contains long string with (Indicator: "Get-Content"; Source: "00000000-00002496.00000000.66184.00260000.00000004.mdmp") Found string "powershell.exe -windowstyle hidden $derremc = Get-Content 'C:\Users\HAPUBWS\AppData\Local\Temp\Bestridelsers\Coordinated\Forvaringernes\Udrejsetilladelse\Eleusine\Sankthansdagenes199\Rosario.New' ; powershell.exe "$derremc"" (Indicator: "Get-Content"; Source: "00000000-00002496.00000001.66373.00260000.00000004.mdmp") file/memory contains long string with (Indicator: "Get-Content"; Source: "00000000-00004044.00000000.66282.001F0000.00000004.mdmp, 00000000-00004044.00000001.66360.001F0000.00000004.mdmp") Found string "powershell.exe -windowstyle hidden $derremc = Get-Content 'C:\Users\HAPUBWS\AppData\Local\Temp\Bestridelsers\Coordinated\Forvaringernes\Udrejsetilladelse\Eleusine\Sankthansdagenes199\Rosario.New' ; powershell.exe "$derremc"" (Indicator: "Get-Content"; Source: "00000000-00004044.00000000.66282.001F0000.00000004.mdmp, 00000000-00004044.00000001.66360.001F0000.00000004.mdmp") Found string "Get-Content" (Indicator: "Get-Content"; Source: "00000000-00004044.00000000.66282.001F0000.00000004.mdmp, 00000000-00004044.00000001.66360.001F0000.00000004.mdmp")3d:T5c7,Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00002496.00000000.66184.00260000.00000004.mdmp, 00000000-00002496.00000001.66373.00260000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00002496.00000000.66184.00260000.00000004.mdmp, 00000000-00002496.00000001.66373.00260000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00002496.00000000.66184.00260000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00002496.00000000.66184.00260000.00000004.mdmp, 00000000-00002496.00000001.66373.00260000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00002496.00000000.66184.00260000.00000004.mdmp, 00000000-00002496.00000001.66373.00260000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002496.00000000.66184.00260000.00000004.mdmp") Found string "indows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00002496.00000001.66373.00260000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002496.00000001.66373.00260000.00000004.mdmp")3e:T552,"RFQ002902999.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "RFQ002902999.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "RFQ002902999.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "RFQ002902999.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DEBUGHEAPFLAGS"; Value: "")3f:T431,"RFQ002902999.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "powershell.exe" reads file "C:\Users\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini" "powershell.exe" reads file "C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini" "powershell.exe" reads file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini" "powershell.exe" reads file "C:\Users\Public\desktop.ini" "powershell.exe" reads file "C:\Users\Public\Desktop\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini" "powershell.exe" reads file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini" "powershell.exe" reads file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini"40:T6b1,"RFQ002902999.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsqB0A8.tmp" with delete access "RFQ002902999.exe" opened "\Device\HarddiskVolume2\ProgramData\Microsoft\Windows\Templates\KORYMBOI241\RADARERS.BEN" with delete access "RFQ002902999.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nssB2CB.tmp" with delete access "RFQ002902999.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nssB2CB.tmp\nsB2EC.tmp" with delete access "RFQ002902999.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nssB2CB.tmp\nsExec.dll" with delete access "powershell.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZGOTQ5XQWOO240PLZIHM.temp" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFfbc6b.TMP" with delete access "powershell.exe" opened "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\SECURITY.CONFIG.CCH.3168.907365915" with delete access "powershell.exe" opened "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\ENTERPRISESEC.CONFIG.CCH.3168.907365915" with delete access "powershell.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Microsoft\CLR SECURITY CONFIG\V2.0.50727.312\SECURITY.CONFIG.CCH.3168.907366352" with delete access41:T603,Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "# Format-Hex cmdlet helps in displaying the Hexadecimal equivalent of the input data." (Indicator: "Format-Hex"; Source: "00000000-00005276.00000001.69171.07550000.00000004.mdmp, 00000000-00005276.00000002.71089.07550000.00000004.mdmp")42:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}43:T13ed,"powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll" at 00000000-00005276-00000C15-47970708 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00005276-00000C15-48295385 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00005276-00000C15-50446305 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll" at 00000000-00005276-00000C15-50540780 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll" at 00000000-00005276-00000C15-50551056 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00005276-00000C15-50625979 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00005276-00000C15-50641310 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00005276-00000C15-50641529 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005276-00000C15-51049703 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll" at 00000000-00005276-00000C15-51652480 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00005276-00000C15-51728825 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00005276-00000C15-51812256 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00005276-00000C15-51812436 "powershell.exe" queries volume information of "C:\" at 00000000-00005276-00000C15-52398511 "powershell.exe" queries volume information of "C:\share" at 00000000-00005276-00000C15-52401615 "powershell.exe" queries volume information of "C:\share" at 00000000-00005276-00000C15-52523110 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005276-00000C15-54003250 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005276-00000C15-54811368 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005276-00000C15-55019914 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005276-00000C15-55245600 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll" at 00000000-00005276-00000C15-55398386 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll" at 00000000-00005276-00000C15-55407103 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00005276-00000C15-55418149 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll" at 00000000-00007928-00000C15-58132691 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00007928-00000C15-5875123644:T8c4,"powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")45:T50b,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")46:T4a5,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00005276.00000000.67251.6FE75000.00000002.mdmp, 00000000-00005276.00000002.71089.6F141000.00000002.mdmp, 00000000-00005276.00000002.71089.6FE75000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00005276.00000000.67251.6FE75000.00000002.mdmp, 00000000-00005276.00000002.71089.6F141000.00000002.mdmp, 00000000-00005276.00000002.71089.6FE75000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00005276.00000000.67251.6FE75000.00000002.mdmp, 00000000-00005276.00000001.69171.00D51000.00000002.mdmp, 00000000-00005276.00000002.71089.6F141000.00000002.mdmp, 00000000-00005276.00000002.71089.6FE75000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00005276.00000000.67251.6FE75000.00000002.mdmp, 00000000-00005276.00000002.71089.6F141000.00000002.mdmp, 00000000-00005276.00000002.71089.6FE75000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00005276.00000001.69171.00D51000.00000002.mdmp")47:Tf0e,Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Press Enter to continue...me of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "= Resolve-Path -LiteralPath $LiteralPath | Foreach-Object ProviderPath" (Indicator: "Resolve-Path"; Source: "00000000-00005276.00000001.69171.07550000.00000004.mdmp, 00000000-00005276.00000002.71089.07550000.00000004.mdmp") Found string "$pathsToProcess += Resolve-Path $Path | Foreach-Object ProviderPath" (Indicator: "Resolve-Path"; Source: "00000000-00005276.00000001.69171.07550000.00000004.mdmp, 00000000-00005276.00000002.71089.07550000.00000004.mdmp") Found string "if(Test-Path -LiteralPath $filePath -PathType Container)" (Indicator: "Test-Path"; Source: "00000000-00005276.00000001.69171.07550000.00000004.mdmp, 00000000-00005276.00000002.71089.07550000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ReadError -ErrorId "FileReadError" -TargetObject $FilePath" (Indicator: "Write-Error"; Source: "00000000-00005276.00000001.69171.07550000.00000004.mdmp, 00000000-00005276.00000002.71089.07550000.00000004.mdmp") Found string "Write-Error -ErrorRecord $errorRecord" (Indicator: "Write-Error"; Source: "00000000-00005276.00000001.69171.07550000.00000004.mdmp, 00000000-00005276.00000002.71089.07550000.00000004.mdmp")48:T882,Found string "Add-Content" (Indicator: "Add-Content"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Import-Alias" (Indicator: "Import-Alias"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Import-Csv" (Indicator: "Import-Csv"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "New-Alias" (Indicator: "New-Alias"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "New-PSDrive" (Indicator: "New-PSDrive"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "New-Variable" (Indicator: "New-Variable"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "New-Module" (Indicator: "New-Module"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Add-PSSnapIn" (Indicator: "Add-PSSnapIn"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Add-History" (Indicator: "Add-History"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "New-ModuleManifest" (Indicator: "New-ModuleManifest"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "New-PSRoleCapabilityFile" (Indicator: "New-PSRoleCapabilityFile"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "New-PSTransportOption" (Indicator: "New-PSTransportOption"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Register-ArgumentCompleter" (Indicator: "Register-ArgumentCompleter"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Add-PSSnapin" (Indicator: "Add-PSSnapIn"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "function New-TemporaryFile" (Indicator: "New-TemporaryFile"; Source: "00000000-00005276.00000001.69171.07550000.00000004.mdmp, 00000000-00005276.00000002.71089.07550000.00000004.mdmp") Found string "function New-Guid" (Indicator: "New-Guid"; Source: "00000000-00005276.00000001.69171.07550000.00000004.mdmp, 00000000-00005276.00000002.71089.07550000.00000004.mdmp")49:Td0c5,Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00005276.00000000.67251.03057000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00005276.00000000.67251.03057000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00005276.00000000.67251.03057000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005276.00000000.67251.03057000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005276.00000000.67251.03057000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?emgvw,czc%wvfyr;usignd9t/t.crd1tm!d5t" - Source: "00000000-00005276.00000000.67251.03057000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005276.00000000.67251.03057000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005276.00000000.67251.03057000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00005276.00000000.67251.03057000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcs5w" - Source: "00000000-00005276.00000000.67251.03057000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.micros1http://www.microsoft.com/pki/docs/cps/defau9iqmgvw,czcs5w" - Source: "00000000-00005276.00000001.69171.03057000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005276.00000001.69171.07550000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005276.00000001.69171.07550000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00005276.00000001.69171.07550000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00005276.00000001.69171.07550000.00000004.mdmp") Found URL "http://www.microsoft.com/powershell" - Source: "00000000-00005276.00000001.69171.07550000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0==w" - Source: "00000000-00005276.00000001.69171.07550000.00000004.mdmp") Found URL "http://wp>p" - Source: "00000000-00005276.00000001.69171.07550000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00005276.00000001.69171.08740000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0qb)v)e=.h7.3:h1oeh?http://crl.mqh.com/pki/crl/prorhcrosoftrootcert.whh0f0d8http://www.micr]hmicr^htcert.crt0ycvded/_&" - Source: "00000000-00005276.00000001.69171.08740000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiictimstapca_2010-07-01.crt0elq6wu" - Source: "00000000-00005276.00000001.69171.094E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005276.00000001.69171.094E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005276.00000001.69171.094E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://w." - Source: "00000000-00005276.00000001.69171.094E0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00005276.00000001.69171.094E0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportmdataoft\winfender\@hrwx" - Source: "00000000-00005276.00000002.71089.02E10000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.micros1http://www.microsoft.com/pki/docs/cps/defau9iqmgvw,czcs5w" - Source: "00000000-00005276.00000002.71089.03057000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005276.00000002.71089.07550000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005276.00000002.71089.07550000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00005276.00000002.71089.07550000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00005276.00000002.71089.07550000.00000004.mdmp") Found URL "http://www.microsoft.com/powershell" - Source: "00000000-00005276.00000002.71089.07550000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0==w" - Source: "00000000-00005276.00000002.71089.07550000.00000004.mdmp") Found URL "http://wp>p" - Source: "00000000-00005276.00000002.71089.07550000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00005276.00000002.71089.08740000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0qb)v)e=.h7.3:h1oeh?http://crl.mqh.com/pki/crl/prorhcrosoftrootcert.whh0f0d8http://www.micr]hmicr^htcert.crt0ycvded/_&" - Source: "00000000-00005276.00000002.71089.08740000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiictimstapca_2010-07-01.crt0elq6wu" - Source: "00000000-00005276.00000002.71089.094E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005276.00000002.71089.094E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005276.00000002.71089.094E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://w." - Source: "00000000-00005276.00000002.71089.094E0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00005276.00000002.71089.094E0000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00005276.00000002.71089.6FE61000.00000020.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00007928.00000001.69833.03570000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00007928.00000001.69833.03570000.00000004.mdmp") Found URL "http://w;" - Source: "00000000-00007928.00000001.69833.03570000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007928.00000001.69833.03570000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007928.00000001.69833.03570000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00007928.00000001.69833.03570000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00007928.00000001.69833.03570000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00007928.00000001.69833.03570000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007928.00000001.69833.03570000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007928.00000001.69833.03570000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007928.00000001.69833.03570000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00007928.00000001.69833.03570000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00007928.00000001.69833.03570000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcwht@thawte," - Source: "00000000-00007928.00000001.69833.03570000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e!$?esystem.transactionssystem.configurationsouredness9substring-doafastctorpdb" - Source: "00000000-00007928.00000001.69833.03570000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007928.00000001.69833.03570000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;verisign," - Source: "00000000-00007928.00000001.69833.03570000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007928.00000001.69833.03570000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0washington1redmond1microsoft" - Source: "00000000-00007928.00000001.69833.03570000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007928.00000001.69833.03570000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00007928.00000001.69833.03570000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007928.00000001.69833.03570000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportindows" - Source: "00000000-00007928.00000001.69833.050B0000.00000004.mdmp") Found URL "http://www.microsoft.com/powershell" - Source: "00000000-00007928.00000001.69833.050B0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1dmond1microsoft" - Source: "00000000-00007928.00000001.69833.050B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007928.00000001.69833.050B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007928.00000001.69833.050B0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00007928.00000001.69833.079D2000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007928.00000001.69833.079D2000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007928.00000001.69833.079D2000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007928.00000001.69833.079D2000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?wqa@0s4q4m6q6q" - Source: "00000000-00007928.00000001.69833.079D2000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007928.00000001.69833.079D2000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00007928.00000001.69833.079D2000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00007928.00000001.69833.079D2000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00007928.00000001.69833.079D2000.00000004.mdmp") Found URL "http://wwjmicrosoft" - Source: "00000000-00007928.00000001.69833.079D2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007928.00000001.69833.079D2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt06qef,npsismyfiletypenpsverifyhash" - Source: "00000000-00007928.00000001.69833.08890000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00007928.00000001.69833.6F0B1000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00007928.00000001.69833.6F0B1000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00007928.00000001.69833.6F0B1000.00000020.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00007928.00000002.71756.03570000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00007928.00000002.71756.03570000.00000004.mdmp") Found URL "http://w;" - Source: "00000000-00007928.00000002.71756.03570000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007928.00000002.71756.03570000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007928.00000002.71756.03570000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00007928.00000002.71756.03570000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00007928.00000002.71756.03570000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00007928.00000002.71756.03570000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007928.00000002.71756.03570000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007928.00000002.71756.03570000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007928.00000002.71756.03570000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00007928.00000002.71756.03570000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00007928.00000002.71756.03570000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcwht@thawte," - Source: "00000000-00007928.00000002.71756.03570000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e!$?esystem.transactionssystem.configurationsouredness9substring-doafastctorpdb" - Source: "00000000-00007928.00000002.71756.03570000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007928.00000002.71756.03570000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;verisign," - Source: "00000000-00007928.00000002.71756.03570000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007928.00000002.71756.03570000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0washington1redmond1microsoft" - Source: "00000000-00007928.00000002.71756.03570000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007928.00000002.71756.03570000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00007928.00000002.71756.03570000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007928.00000002.71756.03570000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportindows" - Source: "00000000-00007928.00000002.71756.050B0000.00000004.mdmp") Found URL "http://www.microsoft.com/powershell" - Source: "00000000-00007928.00000002.71756.050B0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1dmond1microsoft" - Source: "00000000-00007928.00000002.71756.050ED000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007928.00000002.71756.050ED000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007928.00000002.71756.050ED000.00000004.mdmp") Found URL "http://www.microsoft.com/powershell" - Source: "00000000-00007928.00000002.71756.050ED000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=397631&clcid=0x409'$script:psgallerypublishuri" - Source: "00000000-00007928.00000002.71756.062B0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=397527&clcid=0x409'$script:psgalleryscriptsourceuri" - Source: "00000000-00007928.00000002.71756.062B0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=622995&clcid=0x409'" - Source: "00000000-00007928.00000002.71756.062B0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=528403&clcid=0x409'$script:psgalleryv2apiavailable" - Source: "00000000-00007928.00000002.71756.062B0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=698608'$script:nugetprovidername" - Source: "00000000-00007928.00000002.71756.062B0000.00000004.mdmp") Found URL "https://nuget.org/nuget.exe'$script:nugetclientsourceurl" - Source: "00000000-00007928.00000002.71756.062B0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=690216&clcid=0x409'$script:nugetexename" - Source: "00000000-00007928.00000002.71756.062B0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=398575'," - Source: "00000000-00007928.00000002.71756.062B0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=398574')]" - Source: "00000000-00007928.00000002.71756.062B0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=531351'," - Source: "00000000-00007928.00000002.71756.062B0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=398573'," - Source: "00000000-00007928.00000002.71756.062B0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=398576')]" - Source: "00000000-00007928.00000002.71756.062B0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526864')]" - Source: "00000000-00007928.00000002.71756.062B0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526863')]" - Source: "00000000-00007928.00000002.71756.062B0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=517196')]" - Source: "00000000-00007928.00000002.71756.062B0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=733636')]" - Source: "00000000-00007928.00000002.71756.062B0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=718029')]" - Source: "00000000-00007928.00000002.71756.062B0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=619788')]" - Source: "00000000-00007928.00000002.71756.062B0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=619785')]" - Source: "00000000-00007928.00000002.71756.062B0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=619786'," - Source: "00000000-00007928.00000002.71756.062B0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=619784'," - Source: "00000000-00007928.00000002.71756.062B0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=619787')]" - Source: "00000000-00007928.00000002.71756.062B0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=619789')]" - Source: "00000000-00007928.00000002.71756.062B0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=619790')]" - Source: "00000000-00007928.00000002.71756.062B0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=517129')]" - Source: "00000000-00007928.00000002.71756.062B0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=517128')]" - Source: "00000000-00007928.00000002.71756.062B0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=517130')]" - Source: "00000000-00007928.00000002.71756.062B0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=517127')]" - Source: "00000000-00007928.00000002.71756.062B0000.00000004.mdmp") Found URL "https://contoso.com/license.projecturi" - Source: "00000000-00007928.00000002.71756.062B0000.00000004.mdmp") Found URL "https://contoso.com/.iconuri" - Source: "00000000-00007928.00000002.71756.062B0000.00000004.mdmp") Found URL "https://contoso.com/icon.externalmoduledependencies" - Source: "00000000-00007928.00000002.71756.062B0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=619791')]" - Source: "00000000-00007928.00000002.71756.062B0000.00000004.mdmp") Found URL "https://contoso.com/license" - Source: "00000000-00007928.00000002.71756.062B0000.00000004.mdmp") Found URL "https://contoso.com/" - Source: "00000000-00007928.00000002.71756.062B0000.00000004.mdmp") Found URL "https://contoso.com/icon" - Source: "00000000-00007928.00000002.71756.062B0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=619792')]" - Source: "00000000-00007928.00000002.71756.062B0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=619793')]" - Source: "00000000-00007928.00000002.71756.062B0000.00000004.mdmp") Found URL "http://nuget.org/nuget.exe" - Source: "00000000-00007928.00000002.71756.062B0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=619311')]" - Source: "00000000-00007928.00000002.71756.062B0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00007928.00000002.71756.079D2000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007928.00000002.71756.079D2000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007928.00000002.71756.079D2000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007928.00000002.71756.079D2000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?wqa@0s4q4m6q6q" - Source: "00000000-00007928.00000002.71756.079D2000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007928.00000002.71756.079D2000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00007928.00000002.71756.079D2000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00007928.00000002.71756.079D2000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00007928.00000002.71756.079D2000.00000004.mdmp") Found URL "http://wwjmicrosoft" - Source: "00000000-00007928.00000002.71756.079D2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007928.00000002.71756.079D2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt06qef,psismyfiletypepsverifyhash" - Source: "00000000-00007928.00000002.71756.08890000.00000004.mdmp")4a:Ta9c,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp")4b:T7cd,Found string "Select-Object" (Indicator: "Select-Object"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Measure-Object" (Indicator: "Measure-Object"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Compare-Object" (Indicator: "Compare-Object"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "ForEach-Object" (Indicator: "ForEach-Object"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Group-Object" (Indicator: "Group-Object"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Sort-Object" (Indicator: "Sort-Object"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Where-Object" (Indicator: "Where-Object"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Microsoft.PowerShell.Core\Where-Object {$_.Name -match '^Verbs.'} |" (Indicator: "Where-Object"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Select-Object @{" (Indicator: "Select-Object"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "$allVerbs | Microsoft.PowerShell.Core\Where-Object { $_.Verb -like $v }" (Indicator: "Where-Object"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Tee-Object" (Indicator: "Tee-Object"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "= Resolve-Path -LiteralPath $LiteralPath | Foreach-Object ProviderPath" (Indicator: "ForEach-Object"; Source: "00000000-00005276.00000001.69171.07550000.00000004.mdmp, 00000000-00005276.00000002.71089.07550000.00000004.mdmp") Found string "$pathsToProcess += Resolve-Path $Path | Foreach-Object ProviderPath" (Indicator: "ForEach-Object"; Source: "00000000-00005276.00000001.69171.07550000.00000004.mdmp, 00000000-00005276.00000002.71089.07550000.00000004.mdmp")4c:T584,Found string "Set-Variable" (Indicator: "Set-Variable"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Set-StrictMode" (Indicator: "Set-StrictMode"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Enable-PSBreakpoint" (Indicator: "Enable-PSBreakpoint"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Set-PSBreakpoint" (Indicator: "Set-PSBreakpoint"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Set-Location $MyInvocation.MyCommand.Name" (Indicator: "Set-Location"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Set-Location .." (Indicator: "Set-Location"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Set-Location \" (Indicator: "Set-Location"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Set-Alias" (Indicator: "Set-Alias"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Set-Location" (Indicator: "Set-Location"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Set-PSDebug" (Indicator: "Set-PSdebug"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp") Found string "Update-Help" (Indicator: "Update-Help"; Source: "00000000-00005276.00000000.67251.051D0000.00000004.mdmp")4d:T9f8,"RFQ002902999.exe" queried SystemProcessInformation at 00000000-00006548-00000C13-44422215 [PID: 6548] "RFQ002902999.exe" queried SystemProcessInformation at 00000000-00006548-00000C13-44422923 [PID: 6548] "powershell.exe" queried SystemProcessInformation at 00000000-00005276-00000C13-48061592 [PID: 5276] "powershell.exe" queried SystemProcessInformation at 00000000-00005276-00000C13-48063233 [PID: 5276] "powershell.exe" queried SystemProcessInformation at 00000000-00005276-00000C13-49490158 [PID: 5276] "powershell.exe" queried SystemProcessInformation at 00000000-00005276-00000C13-49491149 [PID: 5276] "powershell.exe" queried SystemProcessInformation at 00000000-00005276-00000C13-49992132 [PID: 5276] "powershell.exe" queried SystemProcessInformation at 00000000-00005276-00000C13-49993471 [PID: 5276] "powershell.exe" queried SystemProcessInformation at 00000000-00005276-00000C13-50195204 [PID: 5276] "powershell.exe" queried SystemProcessInformation at 00000000-00005276-00000C13-51444022 [PID: 5276] "powershell.exe" queried SystemProcessInformation at 00000000-00005276-00000C13-52113047 [PID: 5276] "powershell.exe" queried SystemProcessInformation at 00000000-00005276-00000C13-52114534 [PID: 5276] "powershell.exe" queried SystemProcessInformation at 00000000-00005276-00000C13-54605329 [PID: 5276] "powershell.exe" queried SystemProcessInformation at 00000000-00005276-00000C13-54606597 [PID: 5276] "powershell.exe" queried SystemProcessInformation at 00000000-00005276-00000C13-55611839 [PID: 5276] "powershell.exe" queried SystemProcessInformation at 00000000-00005276-00000C13-55612998 [PID: 5276] "powershell.exe" queried SystemProcessInformation at 00000000-00007928-00000C13-58193250 [PID: 7928] "powershell.exe" queried SystemProcessInformation at 00000000-00007928-00000C13-58194243 [PID: 7928] "powershell.exe" queried SystemProcessInformation at 00000000-00007928-00000C13-60323214 [PID: 7928] "powershell.exe" queried SystemProcessInformation at 00000000-00007928-00000C13-60325385 [PID: 7928] "powershell.exe" queried SystemProcessInformation at 00000000-00007928-00000C13-60814407 [PID: 7928] "powershell.exe" queried SystemProcessInformation at 00000000-00007928-00000C13-60815876 [PID: 7928] "powershell.exe" queried SystemProcessInformation at 00000000-00007928-00000C13-61541372 [PID: 7928] "powershell.exe" queried SystemProcessInformation at 00000000-00007928-00000C13-61543251 [PID: 7928] "powershell.exe" queried SystemProcessInformation at 00000000-00007928-00000C13-62915041 [PID: 7928]4e:T9f8,"powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES")4f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACQAAAACgAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAKAAAAAAkAAAAAAAAAAAAAAARmZmZmZmZmZ2ZERGZgAAAGZmZmZmZmZmZmRGZmYAAABmZmZmZmZmZmZkZWZmYAAAZmZmZmZmZmZmZGZmZmAAAGZmZmZmZmZmZmZ2ZndgAApmZmZmZmZmZmZmZmd3YADAZmZmZndmZmZmdmd3d2AAAGZmZmZoZmZmd3Z3d3dgAABmZmZmZ2d3d3d3eHd3cMAJc4////////////+Ih3iIAHeId3d4/////////4iIiAAHdzMzM3//////j////4gABzczMzM3////93d4//+AAAd3MzMzM3////9493//AAAAdzMzMzM4///4eHd/8AAAAHczMzMzM4//iIeP/wCQAAB3d3d3d3d/iId4f/8AAAAAB2ZmZmZmZ3d3cI/8AAAAAAZmZmZmZmeHh3j4AAAAAAkAAAAAAAAAj3gP+gAAAAAAAMmQAAkAAAiMf4AAAAAAAAAAAAAAAAAI+P8AAAAKAAAAAAAAkAAAAI/4AAAAAAAAAAwAAMAAAAAP+AwAAAAAAAAAAAAAAAwACPAAAAAAAAAAAAAKAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAD////////////////////3wADDA8AAAAPAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAADAwwAA4AAAAOAAAAHgAAAD8AAAB/AAAA/wAAAP+AAAH/gAAD///8B////gf///4P////D////4////+f////3/////ww==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"73c38b0fbae15628d39515ffbbe8d71aa8b5ff7c6891ec5f8c1f2fc6a1f0210c","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791693577185,"unified_at":"2026-10-11T04:39:37.185Z","metadata":{"hashes":{"sha256":"73c38b0fbae15628d39515ffbbe8d71aa8b5ff7c6891ec5f8c1f2fc6a1f0210c","sha1":"204df6cd1e8183eb59c6df215c58b420eb7c332f","md5":"9996bf258e329480172796e49489d03e","sha512":"a4b0251d6da0134432a52b76250798c6e258d0eda9f672daafbf301fcb4eb4156f900f0a5701763aefcbb53f2e5537ed98cbc9165d031b2e684a2eab8972ce5f","ssdeep":"12288:1qIl7vEpuZnwI/fvYDNLn7J6cxHY/KqlgsUAjwlJgFp:FvEpAwaHYDN7kcVY/KqljUhQFp","ssdeep_chunks":["12288:1qIl7vE","12288:qIl7vEp","12288:Il7vEpu","12288:l7vEpuZ","12288:7vEpuZn","12288:vEpuZnw","12288:EpuZnwI","12288:puZnwI/","12288:uZnwI/f","12288:ZnwI/fv","12288:nwI/fvY","12288:wI/fvYD","12288:I/fvYDN","12288:/fvYDNL","12288:fvYDNLn","12288:vYDNLn7","12288:YDNLn7J","12288:DNLn7J6","12288:NLn7J6c","12288:Ln7J6cx","12288:n7J6cxH","12288:7J6cxHY","12288:J6cxHY/","12288:6cxHY/K","12288:cxHY/Kq","12288:xHY/Kql","12288:HY/Kqlg","12288:Y/Kqlgs","12288:/KqlgsU","12288:KqlgsUA","12288:qlgsUAj","12288:lgsUAjw","12288:gsUAjwl","12288:sUAjwlJ","12288:UAjwlJg","12288:AjwlJgF","12288:jwlJgFp","24576:1qIl7vE","24576:qIl7vEp","24576:Il7vEpu","24576:l7vEpuZ","24576:7vEpuZn","24576:vEpuZnw","24576:EpuZnwI","24576:puZnwI/","24576:uZnwI/f","24576:ZnwI/fv","24576:nwI/fvY","24576:wI/fvYD","24576:I/fvYDN","24576:/fvYDNL","24576:fvYDNLn","24576:vYDNLn7","24576:YDNLn7J","24576:DNLn7J6","24576:NLn7J6c","24576:Ln7J6cx","24576:n7J6cxH","24576:7J6cxHY","24576:J6cxHY/","24576:6cxHY/K","24576:cxHY/Kq","24576:xHY/Kql","24576:HY/Kqlg","24576:Y/Kqlgs","24576:/KqlgsU","24576:KqlgsUA","24576:qlgsUAj","24576:lgsUAjw","24576:gsUAjwl","24576:sUAjwlJ","24576:UAjwlJg","24576:AjwlJgF","24576:jwlJgFp","12288:FvEpAwa","12288:vEpAwaH","12288:EpAwaHY","12288:pAwaHYD","12288:AwaHYDN","12288:waHYDN7","12288:aHYDN7k","12288:HYDN7kc","12288:YDN7kcV","12288:DN7kcVY","12288:N7kcVY/","12288:7kcVY/K","12288:kcVY/Kq","12288:cVY/Kql","12288:VY/Kqlj","12288:Y/KqljU","12288:/KqljUh","12288:KqljUhQ","12288:qljUhQF","12288:ljUhQFp"],"imphash":"e2a592076b17ef8bfb48b7e03965a3fc"},"file_info":{"file_name":"RFQ 002902999.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":556240,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1703236290000,"last_seen":1787891977000,"last_multi_scan":1787891977000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":11,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":78},"sandbox_signatures":{"informative_count":231,"suspicious_count":19,"malicious_count":7,"total":257},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.70925729","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.70925729 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"Trojan.PowerShell.Generic.aszf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Injector.HGKB-7990","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Adware.Win32.Genus.LXR","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Makoob.Win32.2173","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Privilege Escalation","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to stop a service (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access recent files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"suspicious","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Contains ability to create/modify item values (Powershell command string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to start a process (Powershell command string)"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Attempts to get system information using PowerShell"},{"type":"informative","value":"Retrieves specified items using PowerShell"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Contains ability to retrieve event logs (Powershell command string)"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Discovery","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"},{"type":"informative","value":"Contains ability to delay execution (Powershell command string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Contains ability to move items (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Defense Evasion","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"suspicious","value":"Uses powershell with a windows hidden commandline param"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"},{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to retrieve processes (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Contains ability to get content from a webpage (Powershell command string)"},{"type":"informative","value":"Contains ability to transfer data using curl"},{"type":"informative","value":"Contains ability to copy items (Powershell command string)"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"},{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Defense Evasion","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Defense Evasion","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"Calls an API typically used to acquire handle to a key container within a CSP"},{"type":"informative","value":"PE file contains zero-size sections"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Found XOR operators (encryption/decryption)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Contains ability to run commands or expressions (Powershell command string)"},{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Contains ability to receive remote commands (Powershell command string)"},{"type":"informative","value":"Contains ability to run commands from session history (Powershell command string)"},{"type":"informative","value":"Contains ability to run commands (Powershell command string)"},{"type":"informative","value":"Contains ability to add modules to the current session (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Persistence","technique":"DLL Search Order Hijacking","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"malicious","value":"The input sample is signed with an invalid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"}],"sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to terminate services/features (Powershell command string)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Contains ability to delete a property and its value from an item (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Defense Evasion","technique":"Double File Extension","attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","identifiers":[{"type":"informative","value":"Renames files with double extension (often done by ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"}],"sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"informative","value":"Queries the display settings of system associated file extensions"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"suspicious","value":"Shows ability to use data encoding technique"}],"sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Calls an API typically to import cryptographic keys into a CSP"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to start services (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to call WMI method (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Persistence","technique":"BITS Jobs","attack_id":"T1197","attack_id_wiki":"https://attack.mitre.org/techniques/T1197","identifiers":[{"type":"informative","value":"Contains reference to background jobs (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Persistence","technique":"Windows Management Instrumentation Event Subscription","attack_id":"T1546.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/003","identifiers":[{"type":"informative","value":"Contains ability to create/update instances of WMI classes (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Defense Evasion","technique":"Rename System Utilities","attack_id":"T1036.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/003","identifiers":[{"type":"informative","value":"Contains ability to rename items (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Defense Evasion","technique":"Clear Command History","attack_id":"T1070.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/003","identifiers":[{"type":"informative","value":"Contains ability to clear Powershell session command history (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Defense Evasion","technique":"Match Legitimate Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Contains ability to write/modify file content (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to clear content (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Contains ability to retrieve credential objects (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"suspicious","value":"Contains ability to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Lateral Movement","technique":"Windows Remote Management","attack_id":"T1021.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/006","identifiers":[{"type":"informative","value":"Contains reference to remote powershell session activity (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"sample.bin\"), Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; Source: \"sample.bin\"), Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-77","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyW\" in \"sample.bin\", Found registry deletion API: \"RegDeleteKeyExW\" in \"sample.bin\", Found registry deletion API: \"RegDeleteValueW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-230","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1098","id":"string-132","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1222","id":"string-426","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"SetFileSecurityW\" (Indicator: \"SetFileSecurityW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-114","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$25","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-345","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564","id":"string-269","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"sample.bin\"), Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1570","id":"string-322","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"sample.bin\"), Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-884","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-307","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\"), Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"sample.bin\"), Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoSizeW\" (Indicator: \"GetFileVersionInfo\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoSizeW\" (Indicator: \"GetFileVersionInfoSize\"; Source: \"sample.bin\"), Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoW\" (Indicator: \"GetFileVersionInfo\"; Source: \"sample.bin\"), Found reference to API \"SHGetSpecialFolderLocation\" (Indicator: \"SHGetSpecialFolderLocation\"; Source: \"sample.bin\"), Found reference to API \"GetTempFileNameW\" (Indicator: \"GetTempFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"sample.bin\", Found registry query API: \"RegOpenKeyExW\" in \"sample.bin\", Found registry query API: \"RegEnumValueW\" in \"sample.bin\", Found registry query API: \"RegEnumKeyW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1113","id":"string-78","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-131","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1115","id":"string-188","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageTimeoutW\" (Indicator: \"sendmessage\"; Source: \"sample.bin\"), Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"sample.bin\"), Found reference to API \"FindWindowExW\" (Indicator: \"findwindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"sample.bin\"), Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"sample.bin\"), Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-193","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614.001","id":"string-143","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-413","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-312","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-304","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-409","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-320","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-306","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.1.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"'>|.ve\", Pattern match: \"http://nsis.sf.net/nsis_error\", Heuristic match: \"xq.sl\", Heuristic match: \";w.ls\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"InitiateShutdownW\" (Indicator: \"InitiateShutdown\"; Source: \"sample.bin\"), Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-189","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"RFQ002902999.exe\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8143752'}\" (UID: 00000000-00002496)\n \"RFQ002902999.exe\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8143576'}\" (UID: 00000000-00002496)\n \"RFQ002902999.exe\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8143704'}\" (UID: 00000000-00002496)\n \"RFQ002902999.exe\" called \"LoadResource with parameter {'hModule': '1963655168', 'hResInfo': '24708592'}\" (UID: 00000000-00002496)\n \"RFQ002902999.exe\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8143656'}\" (UID: 00000000-00002496)\n \"RFQ002902999.exe\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8143720'}\" (UID: 00000000-00002496)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to remove a directory","description":"\"RFQ002902999.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\nssB2CB.tmp\\ (UID: 00000000-00002496)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"RFQ 002902999.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00002496.00000001.66373.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00002496.00000000.66184.00786000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002496.00000001.66373.00786000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Renames files","description":"\"powershell.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms\" to \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RFfbc6b.TMP\"\n \"powershell.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\ZGOTQ5XQWOO240PLZIHM.temp\" to \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 3168)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".ndata\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically to import cryptographic keys into a CSP","description":"$26","origin":"API Call","mitre_attack_id":"T1486","relevance":1,"id":"api-233","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to acquire handle to a key container within a CSP","description":"\"powershell.exe\" called \"CryptAcquireContextA\" with parameters {\"phProv\": \"@t!\"\n \"dwProvType\": \"1\"\n \"dwFlags\": \"4026531872\"}","origin":"API Call","mitre_attack_id":"T1027","relevance":1,"id":"api-228","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.899594102116839","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Calls an API typically to import cryptographic keys into a CSP\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"RFQ002902999.exe\" called \"GetForegroundWindow\" (UID: 00000000-00002496)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"RFQ002902999.exe\" called \"IsWow64Process\" with parameter \"2496\" - (UID: 00000000-00002496)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"3168\" - (UID: 00000000-00003168)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00003168)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"RFQ002902999.exe\" called \"GetWindowTextW\" (UID: 00000000-00002496)\n \"RFQ002902999.exe\" called \"GetWindowTextW\" with parameter \"&Close\" - (UID: 00000000-00002496)\n \"RFQ002902999.exe\" called \"GetWindowTextW\" with parameter \"Cancel\" - (UID: 00000000-00002496)\n \"RFQ002902999.exe\" called \"GetWindowTextW\" with parameter \"Retsvsens\" - (UID: 00000000-00002496)\n \"RFQ002902999.exe\" called \"GetWindowTextW\" with parameter \"Show &details\" - (UID: 00000000-00002496)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"RFQ002902999.exe\" called \"GetActiveWindow\" (UID: 00000000-00002496)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"RFQ002902999.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002496)\n \"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003168)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$27","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"RFQ002902999.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00002496)\n \"powershell.exe\" called \"OpenMutexW\" with parameter \"Global\\CLR_CASOFF_MUTEX\" - (UID: 00000000-00003168)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$28","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"RFQ002902999.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002496)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00003168)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003168)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"file/memory contains long string with (Indicator: \"IsWow64Process\"; File: \"nsExec.dll\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002496.00000000.66184.00786000.00000004.mdmp, 00000000-00002496.00000001.66373.00786000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"RFQ 002902999.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"RFQ 002902999.exe\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00002496.00000001.66373.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"RFQ002902999.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"RFQ002902999.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"nsB2EC.tmp\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"nsB2EC.tmp\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; File: \"RFQ 002902999.exe\")\n Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; Source: \"00000000-00002496.00000001.66373.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"RFQ 002902999.exe\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"file/memory contains long string with (Indicator: \"GetStartupInfo\"; File: \"nsExec.dll\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"RFQ002902999.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to access recent files","description":"\"powershell.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms\"\n \"powershell.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\ZGOTQ5XQWOO240PLZIHM.TEMP\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\ZGOTQ5XQWOO240PLZIHM.temp\"\n \"powershell.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RFfbc6b.TMP\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-169","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"RFQ002902999.exe\" called \"CopyFileW\" to copy %TEMP%\\nssB2CB.tmp\\nsExec.dll to new location %TEMP%\\nssB2CB.tmp\\nsB2EC.tmp (UID: 00000000-00002496)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$29","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"RFQ002902999.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\nssB2CB.tmp\\nsB2EC.tmp\" powershell.exe -windowstyle hidden $derremc = Get-Content 'C:\\User\" - (UID: 00000000-00002496)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"RFQ002902999.exe\" called \"NtCreateNamedPipeFile\" (UID: 00000000-00002496)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2b","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"RFQ 002902999.exe\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00002496.00000001.66373.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"RFQ 002902999.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002496.00000001.66373.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"\"nsExec.dll\" contains export function called \"Exec\" at ordinal 1\n \"nsExec.dll\" contains export function called \"ExecToLog\" at ordinal 2\n \"nsExec.dll\" contains export function called \"ExecToStack\" at ordinal 3","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\_SHuassist.mtx\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"\n \"_SHuassist.mtx\"\n \"Global\\CLR_PerfMon_WrapMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"Dullardness.reg\" as clean (type is \"data\")\n Antivirus vendors marked dropped file \"nsExec.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"nsB2EC.tmp\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$2c","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"RFQ 002902999.exe\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"RFQ002902999.exe\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 68630000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\9f895c66454577eff9c77442d0c84f71\\mscorlib.ni.dll\" at 64380000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"RFQ002902999.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76D10000\n \"nsB2EC.tmp\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76D10000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76D10000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"150016003cca7368@ADVAPI32.dll\"\n \"0e000f00ecca7368@ADVAPI32.dll\"\n \"0e000f0048cb7368@ADVAPI32.dll\"\n \"1100120024d37368@ADVAPI32.dll\"\n \"11001200c0d37368@ADVAPI32.dll\"\n \"1200130004d47368@ADVAPI32.dll\"\n \"120013005cd47368@ADVAPI32.dll\"\n \"14001500ecf37368@ADVAPI32.dll\"\n \"1400150004f47368@ADVAPI32.dll\"\n \"140015001cf47368@ADVAPI32.dll\"\n \"1700180034f47368@ADVAPI32.dll\"\n \"0d000e004cf47368@ADVAPI32.dll\"\n \"0d000e00acd47368@SHELL32.dll\"\n \"0d000e0028d57368@SHELL32.dll\"\n \"0f00100078f57368@ADVAPI32.dll\"\n \"14001500b8f57368@ADVAPI32.dll\"\n \"14001500d0f57368@ADVAPI32.dll\"\n \"0c000d0018f67368@ADVAPI32.dll\"\n \"0c000d0028f67368@ADVAPI32.dll\"\n \"0e000f0038f67368@ADVAPI32.dll\"\n \"140015009cf67368@SETUPAPI.dll\"\n \"14001500c8f67368@SETUPAPI.dll\"\n \"15001600e0f67368@SETUPAPI.dll\"\n \"21002200f8f67368@SETUPAPI.dll\"\n \"210022001cf77368@SETUPAPI.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"RFQ 002902999.exe\" was detected as \"Nullsoft Scriptable Install System\" and name: \"Installer\"\n \"RFQ 002902999.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"nsExec.dll\" was detected as \"Nullsoft Scriptable Install System\" and name: \"Installer\"\n \"nsExec.dll\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"RFQ 002902999.exe\" has an executable section named \".text\"\n \"nsExec.dll\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"RFQ 002902999.exe\" has an writable section named \".data\"\n \"RFQ 002902999.exe\" has an writable section named \".ndata\"\n \"nsExec.dll\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$2f","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".data\" is \"0x39eb18\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$30","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"RFQ002902999.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"RFQ002902999.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"RFQ002902999.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Renames files with double extension (often done by ransomware)","description":"\"powershell.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms\" to \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RFfbc6b.TMP\"","origin":"API Call","mitre_attack_id":"T1036.007","relevance":3,"id":"api-163","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"RFQ002902999.exe\" searching for class \"#32770\"\n \"RFQ002902999.exe\" searching for class \"SysListView32\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"nsB2EC.tmp\" with commandline \"powershell.exe -windowstyle hidden $derremc = Get-Content '%T ...\" (UID: 00000000-00004044)\n Spawned process \"powershell.exe\" with commandline \"-windowstyle hidden $derremc = Get-Content '%TEMP%\\\\Bestridels ...\" (UID: 00000000-00003168)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"nsB2EC.tmp\" with commandline \"powershell.exe -windowstyle hidden $derremc = Get-Content '%T ...\" (UID: 00000000-00004044)\n Spawned process \"powershell.exe\" with commandline \"-windowstyle hidden $derremc = Get-Content '%TEMP%\\\\Bestridels ...\" (UID: 00000000-00003168)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"EMAILADDRESS=Indsatsernes@Afkalkningsanlgg.Un, OU=\"angiodermatitis Scorbutical \", O=Sprintets, CN=Sprintets, L=Lansford, ST=Pennsylvania, C=US\" (SHA1: 0C:E7:DC:52:28:F7:24:DC:96:F1:A2:88:57:36:F2:1C:F0:FC:6E:AF; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"RFQ 002902999.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"nsExec.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"$32","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"RFQ002902999.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"RFQ002902999.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"powershell.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$33","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"nsB2EC.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\" - Location: [%TEMP%\\nssB2CB.tmp\\nsB2EC.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$34","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$35","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"RFQ002902999.exe\" reads file \"c:\\users\\%osuser%\\desktop\\desktop.ini\"\n \"RFQ002902999.exe\" reads file \"c:\\rfq002902999.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$36","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$37","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"powershell.exe\" trying to access LNK file \"\\Device\\HarddiskVolume2\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\"\n \"powershell.exe\" trying to access LNK file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\"\n \"powershell.exe\" trying to access LNK file \"Z:\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\"\n \"powershell.exe\" trying to access LNK file \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"\\Device\\HarddiskVolume2\\Windows\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"\\Device\\HarddiskVolume2\\Windows\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$39","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$3a","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"file/memory contains long string with (Indicator: \"CreatePipe\"; File: \"nsExec.dll\")\n file/memory contains long string with (Indicator: \"PeekNamedPipe\"; File: \"nsExec.dll\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00002496.00000000.66184.00786000.00000004.mdmp, 00000000-00002496.00000001.66373.00786000.00000004.mdmp\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00002496.00000000.66184.00786000.00000004.mdmp, 00000000-00002496.00000001.66373.00786000.00000004.mdmp\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00004044.00000001.66360.10002000.00000002.mdmp\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00004044.00000001.66360.10002000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://www.certum.pl\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to get system information using PowerShell","description":"Process \"powershell.exe\" with commandline \"-windowstyle hidden $derremc = Get-Content '%TEMP%\\\\Bestridelsers\\\\Coordinated\\\\Forvaringernes\\\\Udrejsetilladelse\\\\Eleusine\\\\Sankthansdagenes199\\\\Rosario.New' ; powershell.exe \"$derremc\"\" (UID: 00000000-00003168)","origin":"Monitored Target","mitre_attack_id":"T1082","relevance":1,"id":"target-289","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"RFQ002902999.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1174473979\"\n \"cx\": \"426\"\n \"cy\": \"25\"}\n \"RFQ002902999.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"805374622\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"RFQ002902999.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1258359077\"\n \"cx\": \"426\"\n \"cy\": \"25\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000040000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$3b","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"aes\"; File: \"Rosario.New\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"RFQ 002902999.exe\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00002496.00000001.66373.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegEnumValueW\" (Indicator: \"RegEnumValue\"; File: \"RFQ 002902999.exe\")\n Found reference to API \"RegEnumKeyW\" (Indicator: \"RegEnumKey\"; File: \"RFQ 002902999.exe\")\n Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; File: \"RFQ 002902999.exe\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; File: \"RFQ 002902999.exe\")\n Found reference to API \"RegEnumValueW\" (Indicator: \"RegEnumValue\"; Source: \"00000000-00002496.00000001.66373.00408000.00000002.mdmp\")\n Found reference to API \"RegEnumKeyW\" (Indicator: \"RegEnumKey\"; Source: \"00000000-00002496.00000001.66373.00408000.00000002.mdmp\")\n Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00002496.00000001.66373.00408000.00000002.mdmp\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00002496.00000001.66373.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-394","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"RFQ 002902999.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002496.00000001.66373.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Retrieves specified items using PowerShell","description":"Process \"powershell.exe\" with commandline \"-windowstyle hidden $derremc = Get-Content '%TEMP%\\\\Bestridelsers\\\\Coordinated\\\\Forvaringernes\\\\Udrejsetilladelse\\\\Eleusine\\\\Sankthansdagenes199\\\\Rosario.New' ; powershell.exe \"$derremc\"\" (UID: 00000000-00003168)","origin":"Monitored Target","mitre_attack_id":"T1082","relevance":1,"id":"target-477","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003168)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; File: \"RFQ 002902999.exe\")\n Found reference to API \"RegDeleteKeyW\" (Indicator: \"RegDeleteKey\"; File: \"RFQ 002902999.exe\")\n Found reference to API \"RegDeleteKeyExW\" (Indicator: \"RegDeleteKey\"; File: \"RFQ 002902999.exe\")\n Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00002496.00000001.66373.00408000.00000002.mdmp\")\n Found reference to API \"RegDeleteKeyW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00002496.00000001.66373.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"SetFileSecurityW\" which can \"Sets the security of a file or directory object\" [Source: RFQ 002902999.exe]\n Observed import api \"InitializeSecurityDescriptor\" which can \"Initializes a new security descriptor\" [Source: nsExec.dll]\n Observed import api \"SetSecurityDescriptorDacl\" which can \"Sets information in a discretionary access control list (DACL)\" [Source: nsExec.dll]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"RFQ002902999.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.LNK\"; Key: \"ALWAYSSHOWEXT\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\12C\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"nsExec.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\nssB2CB.tmp\\nsExec.dll]- [targetUID: 00000000-00002496]\n \"nsB2EC.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\nssB2CB.tmp\\nsB2EC.tmp]- [targetUID: 00000000-00002496]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"ZGOTQ5XQWOO240PLZIHM.temp\" - Location: [%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\ZGOTQ5XQWOO240PLZIHM.temp]- [targetUID: 00000000-00003168]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"RFQ002902999.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Uses powershell with a windows hidden commandline param","description":"Process \"powershell.exe\" with commandline \"-windowstyle hidden $derremc = Get-Content '%TEMP%\\\\Bestridelsers\\\\Coordinated\\\\Forvaringernes\\\\Udrejsetilladelse\\\\Eleusine\\\\Sankthansdagenes199\\\\Rosario.New' ; powershell.exe \"$derremc\"\" (UID: 00000000-00003168)","origin":"Monitored Target","mitre_attack_id":"T1564.003","relevance":7,"id":"target-114","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.32954915807","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%TEMP%\\Bestridelsers\\Coordinated\\Forvaringernes\\Udrejsetilladelse\\Eleusine\\Sankthansdagenes199\\Dullardness.reg\" has high entropy 7.8776732848147955","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Shows ability to use data encoding technique","description":"The analysis shows indicators which shows data encoded. Matched sigs: Attempts to get system information using PowerShell","origin":"Indicator Combinations","mitre_attack_id":"T1132","relevance":3,"id":"summary-30","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"15/72 Antivirus vendors marked sample as malicious (20% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$3f","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"nsExec.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\nssB2CB.tmp\\nsExec.dll]- [targetUID: 00000000-00002496]\n \"nsB2EC.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\nssB2CB.tmp\\nsB2EC.tmp]- [targetUID: 00000000-00002496]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"RFQ002902999.exe\" wrote 6656 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nssB2CB.tmp\\nsExec.dll\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...\n \"RFQ002902999.exe\" wrote 6656 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nssB2CB.tmp\\nsB2EC.tmp\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"RFQ002902999.exe\" called \"GetAsyncKeyState\" with parameters {\"vKey\": \"27\"}\n \"RFQ002902999.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"18\"}\n \"RFQ002902999.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"17\"}\n \"RFQ002902999.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"16\"}\n \"RFQ002902999.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"91\"}\n \"RFQ002902999.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"92\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"RFQ002902999.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsqB0A8.tmp\" for deletion\n \"RFQ002902999.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nssB2CB.tmp\" for deletion\n \"RFQ002902999.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nssB2CB.tmp\\nsB2EC.tmp\" for deletion\n \"RFQ002902999.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nssB2CB.tmp\\nsExec.dll\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RFfbc6b.TMP\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$40","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"nsExec.dll\" claimed CRC 0 while the actual is CRC 570949","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCreateKeyExW\n RegDeleteValueW\n RegCloseKey\n OpenProcessToken\n RegEnumKeyW\n RegOpenKeyExW\n RegDeleteKeyW\n CopyFileW\n GetModuleFileNameW\n GetFileAttributesW\n GetFileSize\n GetCommandLineW\n LoadLibraryExW\n CreateDirectoryW\n DeleteFileW\n GetProcAddress\n GetTempFileNameW\n GetModuleHandleA\n CreateThread\n GetSystemDirectoryW\n FindNextFileW\n GetTempPathW\n FindFirstFileW\n GetModuleHandleW\n WriteFile\n CreateFileW\n CreateProcessW\n Sleep\n GetTickCount\n ShellExecuteW\n FindWindowExW\n SetSecurityDescriptorDacl\n GetStartupInfoW\n CreateFileMappingW\n MapViewOfFile\n TerminateProcess","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_90% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"15/72 Antivirus vendors marked sample as malicious (20% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"malicious","category":"General","name":"The input sample is signed with an invalid certificate","description":"Error: A certificate chain processed\n but terminated in a root certificate which is not trusted by the trust provider. (0x800b0109)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-1","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"RFQ002902999.exe\" wrote 32 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nssB2CB.tmp\\nsB2EC.tmp\" (Handle: 452)\n \"RFQ002902999.exe\" wrote 52 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nssB2CB.tmp\\nsB2EC.tmp\" (Handle: 452)\n \"RFQ002902999.exe\" wrote 4 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nssB2CB.tmp\\nsB2EC.tmp\" (Handle: 452)\n \"nsB2EC.tmp\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 116)\n \"nsB2EC.tmp\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 116)\n \"nsB2EC.tmp\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 116)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00005276)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00005276)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00005276)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00005276)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to clear Powershell session command history (Powershell command string)","description":"Found string \"Clear-History\" (Indicator: \"Clear-History\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.003","relevance":1,"id":"string-243","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to clear content (Powershell command string)","description":"Found string \"Clear-Host\" (Indicator: \"Clear-Host\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")\n Found string \"Clear-Content\" (Indicator: \"Clear-Content\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")\n Found string \"Clear-ItemProperty\" (Indicator: \"Clear-ItemProperty\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")\n Found string \"Clear-Variable\" (Indicator: \"Clear-Variable\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-368","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution (Powershell command string)","description":"Found string \"Start-Sleep\" (Indicator: \"Start-Sleep\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-397","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify data representation (Powershell command string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to rename items (Powershell command string)","description":"Found string \"Rename-ItemProperty\" (Indicator: \"Rename-ItemProperty\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1036.003","relevance":1,"id":"string-381","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00005276.00000000.67251.02F80000.00000004.mdmp, 00000000-00005276.00000000.67251.03057000.00000004.mdmp, 00000000-00005276.00000000.67251.07550000.00000004.mdmp, 00000000-00005276.00000001.69171.02F80000.00000004.mdmp, 00000000-00005276.00000001.69171.03057000.00000004.mdmp, 00000000-00005276.00000001.69171.07550000.00000004.mdmp, 00000000-00005276.00000002.71089.02F80000.00000004.mdmp, 00000000-00005276.00000002.71089.03057000.00000004.mdmp, 00000000-00005276.00000002.71089.07550000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to write/modify file content (Powershell command string)","description":"Found string \"Set-Content\" (Indicator: \"Set-Content\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1036.005","relevance":1,"id":"string-331","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00005276.00000000.67251.02F80000.00000004.mdmp\n 00000000-00005276.00000001.69171.02F80000.00000004.mdmp\n 00000000-00005276.00000002.71089.02F80000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\pipe\\PSHost.133477100579441574.5276.DefaultAppDomain.powershell; Source: \"00000000-00005276-00000C52-51456931\")\n Found string - \\\\.\\pipe\\PSHost.133477101464105148.7928.DefaultAppDomain.powershell; Source: \"00000000-00007928-00000C52-62919480\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$42","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00005276.00000002.71089.08270000.00000004.mdmp\")\n Found string \"psrsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00005276.00000002.71089.083E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00005276.00000001.69171.07550000.00000004.mdmp, 00000000-00005276.00000002.71089.07550000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Cryptographic Related","name":"Found XOR operators (encryption/decryption)","description":"Found string \"D ^ 2\" (Indicator: \" ^ \"; Source: \"00000000-00005276.00000001.69171.07780000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Found XOR operators (encryption/decryption)","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Possibly tries to communicate over SSL connection (HTTPS)","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00005276)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00005276)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00007928)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00007928)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005276.00000000.67251.6FE75000.00000002.mdmp, 00000000-00005276.00000001.69171.00D51000.00000002.mdmp, 00000000-00005276.00000002.71089.6F141000.00000002.mdmp, 00000000-00005276.00000002.71089.6FE75000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00005276.00000001.69171.00D51000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005276.00000000.67251.6FE75000.00000002.mdmp, 00000000-00005276.00000001.69171.00D51000.00000002.mdmp, 00000000-00005276.00000002.71089.6F141000.00000002.mdmp, 00000000-00005276.00000002.71089.6FE75000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005276.00000000.67251.6FE75000.00000002.mdmp, 00000000-00005276.00000001.69171.00D51000.00000002.mdmp, 00000000-00005276.00000002.71089.6F141000.00000002.mdmp, 00000000-00005276.00000002.71089.6FE75000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$43","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00005276-00000C15-52398511\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00007928-00000C15-64092120","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$44","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$45","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00005276)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00007928)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Contains ability to add modules to the current session (Powershell command string)","description":"Found string \"Import-Module\" (Indicator: \"Import-Module\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-348","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Contains ability to call WMI method (Powershell command string)","description":"Found string \"Invoke-WMIMethod\" (Indicator: \"Invoke-WmiMethod\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-296","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Contains ability to run commands (Powershell command string)","description":"Found string \"Invoke-Command\" (Indicator: \"Invoke-Command\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-287","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Contains ability to run commands or expressions (Powershell command string)","description":"Found string \"Invoke-Expression\" (Indicator: \"Invoke-Expression\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-288","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Powershell command string)","description":"Found string \"Start-Process\" (Indicator: \"Start-Process\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-250","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Contains ability to start services (Powershell command string)","description":"Found string \"Start-Service\" (Indicator: \"Start-Service\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-332","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.133477100579441574.5276.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.133477101464105148.7928.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 6FE80000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"RFQ002902999.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 755B0000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 755B0000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73150000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 726D0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"$47","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"powershell.exe\" (UID: 00000000-00005276) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"powershell.exe\" (UID: 00000000-00005276) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"powershell.exe\" (UID: 00000000-00007928) was launched with modified environment variables: \"PSModulePath, PATHEXT\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/modify Windows services (Powershell command string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-396","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/update instances of WMI classes (Powershell command string)","description":"Found string \"Set-WMIInstance\" (Indicator: \"Set-WmiInstance\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1546.003","relevance":1,"id":"string-336","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains reference to background jobs (Powershell command string)","description":"Found string \"Get-Job\" (Indicator: \"Get-Job\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")\n Found string \"Stop-Job\" (Indicator: \"Stop-Job\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")\n Found string \"Wait-Job\" (Indicator: \"Wait-Job\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")\n Found string \"Resume-Job\" (Indicator: \"Resume-Job\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")\n Found string \"Remove-Job\" (Indicator: \"Remove-Job\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")\n Found string \"Receive-Job\" (Indicator: \"Receive-Job\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")\n Found string \"Start-Job\" (Indicator: \"Start-Job\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")\n Found string \"Debug-Job\" (Indicator: \"Debug-Job\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1197","relevance":1,"id":"string-375","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"RFQ002902999.exe\" queries basic process information of the \"C:\\RFQ002902999.exe\" (UID: 6548)\n \"RFQ002902999.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 6548)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"powershell.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log\"\n \"powershell.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to copy items (Powershell command string)","description":"Found string \"Copy-ItemProperty\" (Indicator: \"Copy-ItemProperty\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-377","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to get content from a webpage (Powershell command string)","description":"Found string \"Invoke-WebRequest\" (Indicator: \"Invoke-WebRequest\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-282","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to move items (Powershell command string)","description":"Found string \"Move-ItemProperty\" (Indicator: \"Move-ItemProperty\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-378","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"Observed string: \"curl\" (Indicator: \"curl\") in Source: 00000000-00005276.00000000.67251.051D0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-576","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$49","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to receive remote commands (Powershell command string)","description":"Found string \"Enable-PSRemoting\" (Indicator: \"Enable-PSRemoting\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-289","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Remote Access Related","name":"Contains reference to remote powershell session activity (Powershell command string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1021.006","relevance":1,"id":"string-154","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE310764CB3903870237917E8B432D]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005276.00000000.67251.02F80000.00000004.mdmp, 00000000-00005276.00000001.69171.02F80000.00000004.mdmp, 00000000-00005276.00000002.71089.02F80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00005276)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00007928)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00005276)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00007928)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-374","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve event logs (Powershell command string)","description":"Found string \"PowerShell -Command {Get-EventLog -LogName security}\" (Indicator: \"Get-EventLog\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")\n Found string \"PowerShell -Command \"& {Get-EventLog -LogName security}\"\" (Indicator: \"Get-EventLog\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-300","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"where the quotation marks indicate a string and the invoke operator (&)\" (Indicator: \"where \"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00005276.00000000.67251.6FE75000.00000002.mdmp, 00000000-00005276.00000002.71089.6F141000.00000002.mdmp, 00000000-00005276.00000002.71089.6FE75000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve processes (Powershell command string)","description":"Found string \"Get-Process\" (Indicator: \"Get-Process\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-291","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"passwordderivebytes\" (Indicator: \"password\"; Source: \"00000000-00005276.00000001.69171.083B0000.00000004.mdmp\")\n Found string \"passwordpropertytextattribute\" (Indicator: \"password\"; Source: \"00000000-00005276.00000001.69171.08400000.00000004.mdmp\")\n Found string \"sha1fornonsecretpurposes\" (Indicator: \"secret\"; Source: \"00000000-00005276.00000002.71089.08270000.00000004.mdmp\")\n Found string \"secretagreementflags\" (Indicator: \"secret\"; Source: \"00000000-00005276.00000002.71089.083E0000.00000004.mdmp\")\n Found string \"safencryptsecrethandle\" (Indicator: \"secret\"; Source: \"00000000-00005276.00000002.71089.083E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"System Security","name":"Contains ability to create/modify item values (Powershell command string)","description":"Found string \"Set-ItemProperty\" (Indicator: \"Set-ItemProperty\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-367","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete a property and its value from an item (Powershell command string)","description":"Found string \"Remove-Module\" (Indicator: \"Remove-Module\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")\n Found string \"Remove-Variable\" (Indicator: \"Remove-Variable\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")\n Found string \"Remove-PSBreakpoint\" (Indicator: \"Remove-PSBreakpoint\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")\n Found string \"Remove-PSDrive\" (Indicator: \"Remove-PSDrive\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")\n Found string \"Remove-ItemProperty\" (Indicator: \"Remove-ItemProperty\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")\n Found string \"Remove-PSSnapin\" (Indicator: \"Remove-PSSnapin\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")\n Found string \"Remove-WMIObject\" (Indicator: \"Remove-WmiObject\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-369","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"System Security","name":"Contains ability to retrieve credential objects (Powershell command string)","description":"Found string \"Get-Credential\" (Indicator: \"Get-Credential\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1003","relevance":1,"id":"string-340","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"System Security","name":"Contains ability to stop a service (Powershell command string)","description":"Found string \"Stop-Service\" (Indicator: \"Stop-Service\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-274","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate services/features (Powershell command string)","description":"Found string \"Disable-PSBreakpoint\" (Indicator: \"Disable-PSBreakpoint\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")\n Found string \"Stop-Process\" (Indicator: \"Stop-Process\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")\n Found string \"Disable-PSRemoting\" (Indicator: \"Disable-PSRemoting\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-371","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to redirect output to specified device/utility (Powershell command string)","description":"Found string \"Out-Default\" (Indicator: \"Out-Default\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")\n Found string \"Out-File\" (Indicator: \"Out-File\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")\n Found string \"Out-Null\" (Indicator: \"Out-Null\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")\n Found string \"Out-String\" (Indicator: \"Out-String\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")\n Found string \".ForwardHelpTargetName Out-String\" (Indicator: \"Out-String\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")\n Found string \"Out-Host\" (Indicator: \"Out-Host\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")\n Found string \"Out-GridView\" (Indicator: \"Out-GridView\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")\n Found string \"Out-Printer\" (Indicator: \"Out-Printer\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-373","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to run commands from session history (Powershell command string)","description":"Found string \"Invoke-History\" (Indicator: \"Invoke-History\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-347","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"$4d","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"RFQ002902999.exe\" (Thread ID: 5192) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to identify remote systems","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00005276.00000001.69171.08400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00005276)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter D:\\ (UID: 00000000-00005276)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00005276)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"Press Enter to continue...me of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmd\" (Indicator: \"hostname\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")\n Found string \"Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified.\" (Indicator: \"hostname\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")\n Found string \"Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.\" (Indicator: \"hostname\"; Source: \"00000000-00005276.00000000.67251.051D0000.00000004.mdmp\")\n Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00005276.00000001.69171.08400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$4e","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]}],"intel_graph":{"map":{"File:088ec84ffeff4cd64877462bc206e32c0cbed29879ba5bb6ec765fd729f202c2":{"type":"File","value":"088ec84ffeff4cd64877462bc206e32c0cbed29879ba5bb6ec765fd729f202c2"},"File:22175b062befc59c5849a3b6d7d866763bd8f9d7478c17c17e81f4d6a6a2ca92":{"type":"File","value":"22175b062befc59c5849a3b6d7d866763bd8f9d7478c17c17e81f4d6a6a2ca92"},"File:2f6713a8b360b4df318899ddf17125e491cc9983969ed825eaae2c887398c000":{"type":"File","value":"2f6713a8b360b4df318899ddf17125e491cc9983969ed825eaae2c887398c000"},"File:5a410fb2dcee4cd73ea6884560cf83d4e9eedb9c43885b32089653a3ef5b6dda":{"type":"File","value":"5a410fb2dcee4cd73ea6884560cf83d4e9eedb9c43885b32089653a3ef5b6dda"},"File:73c38b0fbae15628d39515ffbbe8d71aa8b5ff7c6891ec5f8c1f2fc6a1f0210c":{"type":"File","value":"73c38b0fbae15628d39515ffbbe8d71aa8b5ff7c6891ec5f8c1f2fc6a1f0210c"},"File:7b51372117960e84d6f5eb3a26810cc044ff02283b3d656a0a456b0ab5cb8ea7":{"type":"File","value":"7b51372117960e84d6f5eb3a26810cc044ff02283b3d656a0a456b0ab5cb8ea7"},"File:89bef5bc5a59f7acda1e6d6b23f36d3cb49d7f2bdcf0e73ac7a4bef4b1831e9c":{"type":"File","value":"89bef5bc5a59f7acda1e6d6b23f36d3cb49d7f2bdcf0e73ac7a4bef4b1831e9c"},"File:cf3c58afe9ffc77380a506c0989f418a7c4d7f3d66abbd3367f61abf5a982e5c":{"type":"File","value":"cf3c58afe9ffc77380a506c0989f418a7c4d7f3d66abbd3367f61abf5a982e5c"},"File:d010bc8573a01cabbc5d8e462dee6a3abda7f1ab974c9609d22b8ded3d2ca9c8":{"type":"File","value":"d010bc8573a01cabbc5d8e462dee6a3abda7f1ab974c9609d22b8ded3d2ca9c8"},"File:ea6420ed4e1f8ebcb480704ad9d60455d164ffaf85dc79fee1669b79ca1f91d6":{"type":"File","value":"ea6420ed4e1f8ebcb480704ad9d60455d164ffaf85dc79fee1669b79ca1f91d6"},"File:f39899176c6ab9e8e8c405cb994d59d51a177a1ef9d8d83ae738c706c6159bf8":{"type":"File","value":"f39899176c6ab9e8e8c405cb994d59d51a177a1ef9d8d83ae738c706c6159bf8"},"File:fffd191affb8b8f21d47249be0ce67a6e4158da326170c746832d22fcfd3f5b2":{"type":"File","value":"fffd191affb8b8f21d47249be0ce67a6e4158da326170c746832d22fcfd3f5b2"}},"chains":[{"id":"sandbox_files","root":"File:73c38b0fbae15628d39515ffbbe8d71aa8b5ff7c6891ec5f8c1f2fc6a1f0210c","edges":[{"edge_kind":"extracted","from_key":"File:73c38b0fbae15628d39515ffbbe8d71aa8b5ff7c6891ec5f8c1f2fc6a1f0210c","to_key":"File:2f6713a8b360b4df318899ddf17125e491cc9983969ed825eaae2c887398c000"},{"edge_kind":"extracted","from_key":"File:73c38b0fbae15628d39515ffbbe8d71aa8b5ff7c6891ec5f8c1f2fc6a1f0210c","to_key":"File:7b51372117960e84d6f5eb3a26810cc044ff02283b3d656a0a456b0ab5cb8ea7"},{"edge_kind":"extracted","from_key":"File:73c38b0fbae15628d39515ffbbe8d71aa8b5ff7c6891ec5f8c1f2fc6a1f0210c","to_key":"File:7b51372117960e84d6f5eb3a26810cc044ff02283b3d656a0a456b0ab5cb8ea7"},{"edge_kind":"extracted","from_key":"File:73c38b0fbae15628d39515ffbbe8d71aa8b5ff7c6891ec5f8c1f2fc6a1f0210c","to_key":"File:f39899176c6ab9e8e8c405cb994d59d51a177a1ef9d8d83ae738c706c6159bf8"},{"edge_kind":"extracted","from_key":"File:73c38b0fbae15628d39515ffbbe8d71aa8b5ff7c6891ec5f8c1f2fc6a1f0210c","to_key":"File:ea6420ed4e1f8ebcb480704ad9d60455d164ffaf85dc79fee1669b79ca1f91d6"},{"edge_kind":"extracted","from_key":"File:73c38b0fbae15628d39515ffbbe8d71aa8b5ff7c6891ec5f8c1f2fc6a1f0210c","to_key":"File:89bef5bc5a59f7acda1e6d6b23f36d3cb49d7f2bdcf0e73ac7a4bef4b1831e9c"},{"edge_kind":"extracted","from_key":"File:73c38b0fbae15628d39515ffbbe8d71aa8b5ff7c6891ec5f8c1f2fc6a1f0210c","to_key":"File:fffd191affb8b8f21d47249be0ce67a6e4158da326170c746832d22fcfd3f5b2"},{"edge_kind":"extracted","from_key":"File:73c38b0fbae15628d39515ffbbe8d71aa8b5ff7c6891ec5f8c1f2fc6a1f0210c","to_key":"File:088ec84ffeff4cd64877462bc206e32c0cbed29879ba5bb6ec765fd729f202c2"},{"edge_kind":"extracted","from_key":"File:73c38b0fbae15628d39515ffbbe8d71aa8b5ff7c6891ec5f8c1f2fc6a1f0210c","to_key":"File:5a410fb2dcee4cd73ea6884560cf83d4e9eedb9c43885b32089653a3ef5b6dda"},{"edge_kind":"extracted","from_key":"File:73c38b0fbae15628d39515ffbbe8d71aa8b5ff7c6891ec5f8c1f2fc6a1f0210c","to_key":"File:22175b062befc59c5849a3b6d7d866763bd8f9d7478c17c17e81f4d6a6a2ca92"},{"edge_kind":"extracted","from_key":"File:73c38b0fbae15628d39515ffbbe8d71aa8b5ff7c6891ec5f8c1f2fc6a1f0210c","to_key":"File:cf3c58afe9ffc77380a506c0989f418a7c4d7f3d66abbd3367f61abf5a982e5c"},{"edge_kind":"extracted","from_key":"File:73c38b0fbae15628d39515ffbbe8d71aa8b5ff7c6891ec5f8c1f2fc6a1f0210c","to_key":"File:d010bc8573a01cabbc5d8e462dee6a3abda7f1ab974c9609d22b8ded3d2ca9c8"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":10,"imported_dlls_count":142,"dropped_files_count":0,"extracted_files_count":12,"files_written_count":26,"files_deleted_count":0,"registry_keys_created_count":22,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":22,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"658552f2f7fc76e4dc0ef0c3","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"UDS:Trojan.Makoob","submit_name":"RFQ 002902999.exe","analysis_start_time":"2023-12-22T09:12:18+00:00","indicators_count":{"informative":149,"suspicious":25,"malicious":5},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true},{"id":"658552c2fc628973a8089d0f","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"UDS:Trojan.Makoob","submit_name":"RFQ 002902999.exe","analysis_start_time":"2023-12-22T09:11:30+00:00","indicators_count":{"informative":201,"suspicious":41,"malicious":5},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"}],"processes":[{"pid":2496,"ppid":0,"name":"RFQ002902999.exe","command_line":"","sha256":"73c38b0fbae15628d39515ffbbe8d71aa8b5ff7c6891ec5f8c1f2fc6a1f0210c","normalized_path":"C:\\RFQ002902999.exe","uid":"00000000-00002496","icon":"$4f"},{"pid":4044,"ppid":2496,"name":"nsB2EC.tmp","command_line":"powershell.exe -windowstyle hidden $derremc = Get-Content '%TEMP%\\Bestridelsers\\Coordinated\\Forvaringernes\\Udrejsetilladelse\\Eleusine\\Sankthansdagenes199\\Rosario.New' ; powershell.exe \"$derremc\"","sha256":"503c52dbbb37c87d07a594a90dd2eea4e1f80c9578a9ea295e493171457aff5d","normalized_path":"%TEMP%\\nssB2CB.tmp\\nsB2EC.tmp","parent_uid":"00000000-00002496","uid":"00000000-00004044"},{"pid":3168,"ppid":4044,"name":"powershell.exe","command_line":"-windowstyle hidden $derremc = Get-Content '%TEMP%\\Bestridelsers\\Coordinated\\Forvaringernes\\Udrejsetilladelse\\Eleusine\\Sankthansdagenes199\\Rosario.New' ; powershell.exe \"$derremc\"","sha256":"6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00004044","uid":"00000000-00003168"}],"all_imported_dlls":["api-ms-win-core-synch-l1-2-0.dll","dwmapi.dll","oleacc.dll","cscapi.dll","System.Management.Automation.dll","psapi.dll","System.Transactions.dll","nsExec.dll","Microsoft.WSMan.Management.ni.dll","nsi.dll","rsaenh.dll","System.Data.dll","lpk.dll","rpcrt4.dll","riched20.dll","Microsoft.PowerShell.Commands.Diagnostics.ni.dll","System.Transactions.ni.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","ntdll.dll","userenv.dll","setupapi.dll","ntmarta.dll","mscoree.dll","linkinfo.dll","System.Core.ni.dll","mscorrc.dll","System.Xml.ni.dll","gdi32.dll","devobj.dll","fltLib.dll","atl.dll","srvcli.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","Microsoft.WSMan.Runtime.dll","Microsoft.PowerShell.Commands.Management.ni.dll","VxSSL32.dll","apphelp.dll","cryptbase.dll","oleaccrc.dll","clbcatq.dll","System.ni.dll","Microsoft.PowerShell.Security.ni.dll","Culture.dll","comctl32.dll","imm32.dll","cfgmgr32.dll","oleaut32.dll","shdocvw.dll","mscorwks.dll","System.Configuration.Install.ni.dll","System.DirectoryServices.ni.dll","user32.dll","shell32.dll","sechost.dll","ole32.dll","msctf.dll","System.Management.ni.dll","tzres.dll","System.Data.ni.dll","kernel32.dll","shlwapi.dll","profapi.dll","shfolder.dll","mscorjit.dll","KernelBase.dll","advapi32.dll","propsys.dll","System.Management.Automation.ni.dll","sspicli.dll","crypt32.dll","usp10.dll","rpcss.dll","Wldap32.dll","ntshrui.dll","slc.dll","cryptsp.dll","diasymreader.dll","msvcrt.dll","ws2_32.dll","version.dll","msvcr80.dll","msasn1.dll","uxtheme.dll","mscoreei.dll","mscorlib.ni.dll","secur32.dll","netutils.dll","TextInputFramework.dll","IPHLPAPI.DLL","Microsoft.PowerShell.Commands.Management.dll","wow64.dll","combase.dll","ucrtbase_clr0400.dll","ucrtbase.dll","wintrust.dll","Microsoft.PowerShell.Security.dll","bcryptprimitives.dll","System.Management.dll","SHCore.dll","gpapi.dll","System.Configuration.ni.dll","wldp.dll","sppc.dll","wshext.dll","Microsoft.Management.Infrastructure.ni.dll","System.Configuration.Install.dll","wow64cpu.dll","WinTypes.dll","amsi.dll","OpcServices.dll","winnsi.dll","System.ServiceProcess.dll","System.Windows.Forms.dll","CoreUIComponents.dll","vcruntime140_clr0400.dll","AppxSip.dll","pwrshsip.dll","System.DirectoryServices.dll","imagehlp.dll","iertutil.dll","cryptnet.dll","Microsoft.PowerShell.Commands.Utility.dll","windows.storage.dll","urlmon.dll","gdi32full.dll","powrprof.dll","Microsoft.PowerShell.ConsoleHost.dll","coml2.dll","xmllite.dll","CoreMessaging.dll","System.Numerics.dll","MpClient.dll","msisip.dll","msvcp_win.dll","clrjit.dll","wow64win.dll","msls31.dll","clr.dll","bcrypt.dll","kernel.appcore.dll","MpOAV.dll","win32u.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Dullardness.reg","sha256":"2f6713a8b360b4df318899ddf17125e491cc9983969ed825eaae2c887398c000","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"name":"nsB2EC.tmp","sha256":"7b51372117960e84d6f5eb3a26810cc044ff02283b3d656a0a456b0ab5cb8ea7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"}]},{"name":"nsExec.dll","sha256":"7b51372117960e84d6f5eb3a26810cc044ff02283b3d656a0a456b0ab5cb8ea7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"name":"Rosario.New","sha256":"f39899176c6ab9e8e8c405cb994d59d51a177a1ef9d8d83ae738c706c6159bf8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"name":"ZGOTQ5XQWOO240PLZIHM.temp","sha256":"ea6420ed4e1f8ebcb480704ad9d60455d164ffaf85dc79fee1669b79ca1f91d6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"}]},{"name":"Penlightceller.cru","sha256":"89bef5bc5a59f7acda1e6d6b23f36d3cb49d7f2bdcf0e73ac7a4bef4b1831e9c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"name":"argoternes.txt","sha256":"fffd191affb8b8f21d47249be0ce67a6e4158da326170c746832d22fcfd3f5b2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"name":"gallons.arv","sha256":"088ec84ffeff4cd64877462bc206e32c0cbed29879ba5bb6ec765fd729f202c2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"name":"columbae.occ","sha256":"5a410fb2dcee4cd73ea6884560cf83d4e9eedb9c43885b32089653a3ef5b6dda","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"name":"powershell.exe.log","sha256":"22175b062befc59c5849a3b6d7d866763bd8f9d7478c17c17e81f4d6a6a2ca92","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"name":"ModuleAnalysisCache","sha256":"cf3c58afe9ffc77380a506c0989f418a7c4d7f3d66abbd3367f61abf5a982e5c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"name":"StartupProfileData-NonInteractive","sha256":"d010bc8573a01cabbc5d8e462dee6a3abda7f1ab974c9609d22b8ded3d2ca9c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"path":"%TEMP%\\nsqB0A8.tmp","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"}]},{"path":"%SAMPLEDIR%\\Users","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"path":"%SAMPLEDIR%\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"path":"%TEMP%\\Bestridelsers","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"path":"%TEMP%\\Bestridelsers\\Coordinated","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"path":"%TEMP%\\Bestridelsers\\Coordinated\\Forvaringernes\\Udrejsetilladelse\\Eleusine\\Sankthansdagenes199\\Dullardness.reg","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"path":"%TEMP%\\Bestridelsers\\Coordinated\\Forvaringernes\\Udrejsetilladelse\\Eleusine\\Sankthansdagenes199\\Rosario.New","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"path":"%TEMP%\\Bestridelsers\\Coordinated\\Forvaringernes\\Udrejsetilladelse\\Eleusine\\Sankthansdagenes199\\Penlightceller.cru","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"path":"%TEMP%\\Bestridelsers\\Coordinated\\Forvaringernes\\Udrejsetilladelse\\Eleusine\\Sankthansdagenes199\\argoternes.txt","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"path":"%TEMP%\\Bestridelsers\\Coordinated\\Stannel17\\Uninterspersed\\Autopotamic\\columbae.occ","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"path":"%TEMP%\\Bestridelsers\\Coordinated\\Interessentselskabs\\gallons.arv","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"path":"%TEMP%\\nssB2CB.tmp","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"}]},{"path":"%TEMP%\\nssB2CB.tmp\\nsExec.dll","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"}]},{"path":"%TEMP%\\nssB2CB.tmp\\nsB2EC.tmp","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\ZGOTQ5XQWOO240PLZIHM.temp","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RFfbc6b.TMP","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"}]},{"path":"%TEMP%\\nsxF217.tmp","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"path":"%TEMP%\\nsaF489.tmp","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"path":"%TEMP%\\nsaF489.tmp\\nsExec.dll","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"},{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"}]},{"name":"_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"}]},{"name":"Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"658552f2f7fc76e4dc0ef0c3"}]},{"name":"Local\\SM0:6548:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"name":"SM0:6548:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"name":"Local\\SM0:5276:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"name":"SM0:5276:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"name":"SM0:7928:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]},{"name":"Local\\SM0:7928:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"658552c2fc628973a8089d0f"}]}]}},"report_ids":{"sandbox_job_ids":["658552f2f7fc76e4dc0ef0c3","658552c2fc628973a8089d0f"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 73c38b0fbae1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 73c38b0fbae1…. Malware family: Trojan.Generic. Threat score 100/100. 11/25 AV engines flagged this file. 7 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/73c38b0fbae15628d39515ffbbe8d71aa8b5ff7c6891ec5f8c1f2fc6a1f0210c"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 73c38b0fbae1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 73c38b0fbae1…. Malware family: Trojan.Generic. Threat score 100/100. 11/25 AV engines flagged this file. 7 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/73c38b0fbae15628d39515ffbbe8d71aa8b5ff7c6891ec5f8c1f2fc6a1f0210c"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 73c38b0fbae1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 73c38b0fbae1…. Malware family: Trojan.Generic. Threat score 100/100. 11/25 AV engines flagged this file. 7 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L50","11",{}]]