24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 4e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T49e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious CMD:BZC.PZQ.Boxter.441 Sample 8b4713d64064… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 8b4713d64064…. Malware family: CMD:BZC.PZQ.Boxter.441. Threat score 100/100. 4/27 AV engines flagged this file. 9 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3","keywords":["Malicious","CMD:BZC.PZQ.Boxter.441","malware analysis","sandbox report","threat intelligence","8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3"],"about":{"@type":"SoftwareApplication","name":"lady.ps1","applicationCategory":["powershell","ps"],"identifier":"8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"CMD:BZC.PZQ.Boxter.441","antivirusDetections":{"malicious":4,"total":27},"behavioralIndicators":{"malicious":9,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T506,file/memory contains long string with (Indicator: "VirtualAlloc"; File: "8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin") file/memory contains long string with (Indicator: "VirtualAllocEx"; File: "8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin") file/memory contains long string with (Indicator: "WriteProcessMemory"; File: "8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "kbcc41lv.0.cs") file/memory contains long string with (Indicator: "VirtualAllocEx"; File: "kbcc41lv.0.cs") file/memory contains long string with (Indicator: "WriteProcessMemory"; File: "kbcc41lv.0.cs") Found reference to API "[DllImport("kernel32", EntryPoint="VirtualAllocEx")]" (Indicator: "VirtualAlloc"; File: "8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin") Found reference to API "[DllImport("kernel32", EntryPoint="VirtualAllocEx")]" (Indicator: "VirtualAllocEx"; File: "8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin") Found reference to API "[DllImport("kernel32", EntryPoint="WriteProcessMemory")]" (Indicator: "WriteProcessMemory"; File: "8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin")26:T4a3,file/memory contains long string with (Indicator: "Start-Sleep"; File: "8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin") Found string "Start-Sleep -Seconds 7" (Indicator: "Start-Sleep"; File: "8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin") Found string "Start-Sleep -Seconds 8" (Indicator: "Start-Sleep"; File: "8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin") Found string "Start-Sleep -Milliseconds 1425" (Indicator: "Start-Sleep"; File: "8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin") Found string "Start-Sleep -Milliseconds 1008" (Indicator: "Start-Sleep"; File: "8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin") Found string "Start-Sleep -Milliseconds 810" (Indicator: "Start-Sleep"; File: "8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin") Found string "Start-Sleep -Milliseconds 417" (Indicator: "Start-Sleep"; File: "8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin") Found string "Start-Sleep -Milliseconds 580" (Indicator: "Start-Sleep"; File: "8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin")27:Td85,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLENCODEOBJECT\#2009") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLENCODEOBJECT\#2009") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLENCODEOBJECT\#2010") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLENCODEOBJECT\#2010") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLENCODEOBJECT\#2011") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLENCODEOBJECT\#2011") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLENCODEOBJECT\#2012") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLENCODEOBJECT\#2012") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLENCODEOBJECT\#2130") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLENCODEOBJECT\#2130") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLENCODEOBJECT\#2221") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLENCODEOBJECT\#2221") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLENCODEOBJECT\#2222") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLENCODEOBJECT\#2222") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLENCODEOBJECT\#2223") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLENCODEOBJECT\#2223") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLENCODEOBJECT\1.3.6.1.4.1.311.12.2.1") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLENCODEOBJECT\1.3.6.1.4.1.311.12.2.1") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLENCODEOBJECT\1.3.6.1.4.1.311.12.2.2") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLENCODEOBJECT\1.3.6.1.4.1.311.12.2.2") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLENCODEOBJECT\1.3.6.1.4.1.311.12.2.3") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLENCODEOBJECT\1.3.6.1.4.1.311.12.2.3") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLENCODEOBJECT\1.3.6.1.4.1.311.16.1.1") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLENCODEOBJECT\1.3.6.1.4.1.311.16.1.1") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLENCODEOBJECT\1.3.6.1.4.1.311.16.4")28:T5ae,"powershell.exe" queried SystemProcessInformation at 00000000-00003704-00000C15-1813711973 [PID: 3704] "powershell.exe" queried SystemProcessInformation at 00000000-00003704-00000C15-1813720133 [PID: 3704] "powershell.exe" queried SystemProcessInformation at 00000000-00003704-00000C15-1814688534 [PID: 3704] "powershell.exe" queried SystemProcessInformation at 00000000-00003704-00000C15-1814696473 [PID: 3704] "powershell.exe" queried SystemProcessInformation at 00000000-00003704-00000C15-1817069580 [PID: 3704] "powershell.exe" queried SystemProcessInformation at 00000000-00003704-00000C15-1817112365 [PID: 3704] "powershell.exe" queried SystemProcessInformation at 00000000-00003704-00000C15-1817263037 [PID: 3704] "powershell.exe" queried SystemProcessInformation at 00000000-00003704-00000C15-1817270804 [PID: 3704] "powershell.exe" queried SystemProcessInformation at 00000000-00003704-00000C15-1818052232 [PID: 3704] "powershell.exe" queried SystemProcessInformation at 00000000-00003704-00000C15-1818923858 [PID: 3704] "powershell.exe" queried SystemProcessInformation at 00000000-00003704-00000C15-1818932280 [PID: 3704] "powershell.exe" queried SystemProcessInformation at 00000000-00003704-00000C15-1819364032 [PID: 3704] "powershell.exe" queried SystemProcessInformation at 00000000-00003704-00000C15-1819372331 [PID: 3704] "powershell.exe" queried SystemProcessInformation at 00000000-00003704-00000C15-1821084408 [PID: 3704]29:Tcc3,"powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "20e6a6859a010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "20dfa6859a010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "20e1a6859a010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "b0d99da19a010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "b00d9ea19a010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "b0dc9da19a010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "b0df9da19a010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "b0129ea19a010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "b0f09da19a010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "b0159ea19a010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "b00e9ea19a010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "b0e29da19a010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "b0019ea19a010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "b0069ea19a010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "b0f29da19a010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "b0e39da19a010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "b00c9ea19a010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "b0089ea19a010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "b0e69da19a010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "b0fa9da19a010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "b0e09da19a010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "b0f89da19a010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "b0d89da19a010000" "szProvider": "Microsoft Enhanced RSA and AES Cryptographic Provider" "dwProvType": "24" "dwFlags": "4026531840"}2a:T932,"powershell.exe" called "CryptDecrypt" with parameters {"hKey": "19aa1a1e480" "Final": "0" "dwFlags": "0" "pbData": "e8c0850100c08501000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a052d255f6a32283f79a15705a2f9a5f79dfc1770f2eecec6a83032a8e2e6252c4bc7b878394f9a076f752bdbbdeb3a6f4163ee8186320e0ef7d07017e7c40298fccd6a88566d4b2e59791adb2af283d0b41fbaf1a655fc43379d1d7638a8da85e5544bf165e576fbc968213bff9cf04e49cc17236c1bbed9c18ccbeb147246af992a4601abafae600222908aad0e2e63d6ea87ff5f97c1c08797ab781ec5ca831e3d25e79bd9e1e9b416b44a118a253bdcb0851894f2433a81dabb76bd57d80875fccf48c6c4995218a8370c58e84f3103be13ee147bddf8a9c686925af77bd4d0b14a19914d78a1b44fdcc40d682200c7dce032eb04670ba60563a110cebc1e04cc103c245acf32272e244f6e63c73eb5b19fb53013f3ef966efc27c118b90303a86f790d246a117f64099d37d775750f2dd2608c09593b13fe270018288d3a33e54b5bb266ace90f06b35835f0e6a82846e3a72d06df64b16cd2116c5430b47f2bf17b7b672b8189851dbac3572952e4549108d1c116027d8413e59461d12523d4307e3945f2d59d805ee050da8e969f7d0e7d23737453660512fcc1397434ff8d2e2e912b5c77381471f17de9229a9fc6a29014e918c441aacda128703b276a0c80bb230df8e3401ba33d636d25f2b0f94baf0eff40cec162601057fc6b026ed40d2d9723b6054ecaf91b6ac155d4c225db2b8e5109c00000000000000000100000002000000000000003f0000006f6c6533323b6f6c6561757433323b77696e696e65743b6d73636f7265653b7368656c6c333200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000616d736900000000636c7200776c6470000000006e74646c6c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" "pdwDataLen": "50e80100"} "powershell.exe" called "CryptDecrypt" with parameters {"hKey": "19aa1a1e480" "Final": "1" "dwFlags": "0" "pdwDataLen": "00000000" "$error": "80090004"}2b:T102a,"powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "19a85a00e30" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e09aa6859a010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "19a85a00e30" "pszBlobType": "RSAPUBLICBLOB" "phKey": "30a5a6859a010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "19a85a00e30" "pszBlobType": "RSAPUBLICBLOB" "phKey": "90ed3e899a010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "19a85a00e30" "pszBlobType": "RSAPUBLICBLOB" "phKey": "40ef3e899a010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "19a85a00e30" "pszBlobType": "RSAPUBLICBLOB" "phKey": "60f33e899a010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "19a85a00e30" "pszBlobType": "RSAPUBLICBLOB" "phKey": "d09ba6859a010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "19a85a00e30" "pszBlobType": "RSAPUBLICBLOB" "phKey": "009ca6859a010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "19a85a00e30" "pszBlobType": "RSAPUBLICBLOB" "phKey": "809940899a010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "19a85a00e30" "pszBlobType": "RSAPUBLICBLOB" "phKey": "b09640899a010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "19a85a00e30" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e06c44899a010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "19a85a00e30" "pszBlobType": "RSAPUBLICBLOB" "phKey": "401b45899a010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "19a85a00e30" "pszBlobType": "RSAPUBLICBLOB" "phKey": "601c45899a010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "19a85a00e30" "pszBlobType": "RSAPUBLICBLOB" "phKey": "501a45899a010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "19a85a00e30" "pszBlobType": "RSAPUBLICBLOB" "phKey": "301345899a010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "19a85a00e30" "pszBlobType": "RSAPUBLICBLOB" "phKey": "801445899a010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "19a85a00e30" "pszBlobType": "RSAPUBLICBLOB" "phKey": "001945899a010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "19a85a00e30" "pszBlobType": "RSAPUBLICBLOB" "phKey": "501d45899a010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "19a85a00e30" "pszBlobType": "RSAPUBLICBLOB" "phKey": "b01745899a010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "19a85a00e30" "pszBlobType": "RSAPUBLICBLOB" "phKey": "c01645899a010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "19a893f5ec0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "601945899a010000" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"}2c:T2582,"powershell.exe" called "CryptImportKey" with parameters {"hProv": "19a85a6e620" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "pm"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "19a85a6e620" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "d071a6859a010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "19a85a6e620" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "a076a6859a010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "19a85a6e620" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "006da6859a010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "19a85a6e620" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "b06ba6859a010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "19a85a6df20" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "d0b43f899a010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "19a85a6df20" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "c0b83f899a010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "19a85a6df20" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "80b33f899a010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "19a85a6e620" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "b0ae3f899a010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "19a85a6e620" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "a0b23f899a010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "19a85a6df20" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "b0ae3f899a010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "19a85a6e620" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "00b03f899a010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "19a85a6e620" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "10b33f899a010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "19a85a6e620" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "30b93f899a010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "19a85a6e620" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "d0b43f899a010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "19a85a6e620" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "10ac3f899a010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "19a85a6e620" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "70b03f899a010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "19a85a6e120" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "a0ab3f899a010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "19a85a6e120" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "50b13f899a010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "19a85a6e120" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "30ab3f899a010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "19a85a6df20" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "b00f9ca19a010000"}2d:T705,Contains base64 string in header "MSIE" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "CLR1" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "3705" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "Host" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "MSIE" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org" Contains base64 string in header "CLR1" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org" Contains base64 string in header "3705" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org" Contains base64 string in header "Host" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org" Contains base64 string in header "Keep" in header "GET /xml/64.124.12.162 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive"2e:T40e,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Detected XOR operators (encryption/decryption) Matched sigs: Able to decrypt/decode data Matched sigs: Able to access crypto-related API (String) Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to decrypt data Matched sigs: Script contains XOR (Antimalware Scan Interface) Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt the data Matched sigs: HTTP requests contain Base64 strings2f:T38f4,"powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003704) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003704) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac19889a010000000000000000000051ed9900ff7f0000000000009a0100000000000000000000850ccab7cb3700002a00000000000000c0d29a859a0100008fec9900ff7f0000e0ac19889a010000e0ac19889a010000000000000000000000000000ff7f0000ffffff7f3394000000000000000000000000000000000000d8ce0d889a0100002a0000000000000069c3c6879a0100003100000000000000540200000000000058020000000000001100011000000000a0de38d09900000003a32c00ff7f0000a0de38d09900000000000000000000002b00000000000000000000000000000020b0cc879a010000b43fcb879a010000e0ce0d88 (UID: 00000000-00003704) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000001000000000000000b000000000000000b000000000000005800000000000000000000000000000000000000000000000000120100000000920000000100000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003704) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000360d00000000000080d638d0990000000400000000000000302064b50001000006000000000000000300000000000000a740e3fcfe7f00000000000000000000000000000000000000000000000000000101000000000000b0fb9c859a0100000a000000000000000000000000000000000000000000000043003a005c00550073006500720073000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004989700ff7f00000000000000000000000000000000000000000000 (UID: 00000000-00003704) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000500196859a01000005000000000000004000000000000000ca646697f7a651487cfc0780e6cbd95e0000000000000000c00c96859a0100000000000000000000000096859a0100005000000000000000d0229e859a010000969d9700ff7f00000010000000000000e02d9c859a010000e02d9c859a010000b40296859a01000000100000000000003200300005000000200d96859a0100000000000000000000000096859a010000008043d09900000000000000000000000000000000000000000000000000000004000000010000000000000000000000ffffffff9a01000000000000 (UID: 00000000-00003704) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000008043d09900000000000000000000000000000000000000000000000000000004000000010000000000000000000000ffffffff9a0100000000000000000000000000000000000040f39b859a01000060e238d099000000746e9b859a01000060ef9d859a01000000000000000000000000000000000000000000000000000000000000000000000000000000000000f06e9b859a010000046f9b859a010000f06e9b859a010000feffffffffffffff0000000000000000120e9b859a010000000000000000000000000000000000000000000000000000500196859a010000de3e9700ff7f000020cf38d09900000040cf38d09900000000349e85 (UID: 00000000-00003704) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000fa0c000000000000c0b938d0990000006824be2c657f0000402e63b5000100001affff7f000000002000000000000000a740e3fcfe7f000000c738d0990000000000000000000000e8c038d099000000e300000000000000c0f19b859a0100002b0000000000000070c038d0987880574f8c6244bb63710443003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f006600740000000000cd0b0000e8c038d0990000000000000004989700ff7f00000000000000000000000000000000000000000000 (UID: 00000000-00003704) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000a01496859a0100000000000000000000000096859a010000008043d09900000000000000000000000000000000000000000000000000000000000000000000006c006e0000000000c00c96859a0100000000000000000000800000000000000060b238d09900000000000000000000000000000000000000000000000000000000000000000000000800000000000000601596859a0100000000000000000000000096859a010000008043d09900000040000000000000000000000000000000760000000000000000000000000000000000000000000000ffffffff9a01000000000000 (UID: 00000000-00003704) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000008043d09900000040000000000000000000000000000000760000000000000000000000000000000000000000000000ffffffff9a0100000000000000000000000000000000000040f39b859a010000a0c538d09900000078cd9d859a01000040449e859a0100000000000000000000000000000000000000000000000000000000000000000000000000000000000040d59d859a01000058d59d859a01000040d59d859a010000feffffffffffffff0000000000000000560e9b859a01000000000000000000000000000000000000000000000000000030b338d099000000760000000000000060b238d09900000080b238d09900000000000020 (UID: 00000000-00003704) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000d60c00000000000060ab38d099000000a432be2c657f000040b062b5000100002cffff7f000000003200000000000000a740e3fcfe7f000020509e859a01000096699b00ff7f00000000000000000000d10000000000000030649e859a0100003e000000000000000000000000000000000000000000000043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c005300740061007200740020004d0065006e00750000009a010000602e9c85 (UID: 00000000-00003704) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000601896859a0100000000000000000000000096859a010000008043d09900000000000000000000000000000000000000000000000000000000000000000000009200940000000000c00c96859a0100001300000000000000b00000000000000000a438d09900000000000000000000000000000000000000000000000000000000000000000000000b00000000000000601896859a0100000000000000000000000096859a010000008043d099000000400000000000000000000000000000009c0000000000000000000000000000000000000000000000ffffffff9a01000000000000 (UID: 00000000-00003704) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000c00c00000000000030a438d099000000be39be2c657f000090d265b50001000037ffff7f000000003d00000000000000a740e3fcfe7f000000a438d09900000020a438d0990000000000006f02000000c60000000000000050af9c859a01000047000000000000000200000000000000000000000000000043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c005300740061007200740020004d0065006e0075005c00500072006f006700 (UID: 00000000-00003704) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000e01696859a0100000000000000000000000096859a010000008043d0990000000000000000000000000000000000000000000000000000000000000000000000a400a60000000000c00c96859a0100000900000000000000c000000000000000d09c38d09900000000000000000000000000000000000000000000000000000000000000000000000c00000000000000e01696859a0100000000000000000000000096859a010000008043d099000000400000009a0100000000000000000000ae0000000000000000000000000000000000000000000000ffffffff9a01000000000000 (UID: 00000000-00003704) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000ae0c000000000000009d38d099000000dc40be2c657f000010ba64b50001000040ffff7f000000004600000000000000a740e3fcfe7f0000d09c38d099000000f09c38d09900000000879e8502000000bd0000000000000040269c859a0100005a000000000000000200000000000000000000000000000043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c005300740061007200740020004d0065006e0075005c00500072006f006700 (UID: 00000000-00003704) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000002020207200000000000909638d099000000ffffffffffffffff0100000000000000bc9638d099000000000000003307020233072e0000000000f5000000000000000000000000000000f6aca4d5f25a0000000000000000000000e8ffff7f000000ffffffff00000000000400000000000050879e859a010000909538d099000000909638d099000000ffffffff000000000000000000000000909538d099000000e674e2fcfe7f00007f0000000000000000040000000000002e000000000000002e00000000000000909638d099000000ffffffff00000000000000000000000000000000000000000000000000000000ffffffff9a01000000000000 (UID: 00000000-00003704) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000040f39b859a010000e0a838d09900000038549b859a010000209d9e859a01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffffffffffff0000000000000000b40e9b859a010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003704) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00003704) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000008f7d9e859a010000b7010000000000008f7d9e859a010000247d98859a010000f2010000000000000200000200000000010000004d006900630072006f0073006f006600740000002b17003c9a010000d7496ffdfe7f0000000000000000000070389e859a010000540100550000000000b438d0990000002b17003c9a010000b701000000000000020000020000000052fee5516f93000000000000000000000000000000000000000000000000000000356bfdfe7f0000a0449e859a010000d6679700ff7f0000b70100b69a0100006287e4fcfe7f00002b17003c00000000f2010000000000000000000000000000ffffffff9a01000000000000 (UID: 00000000-00003704) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a9700ff7f0000000098859a01000000000000000000000000000000000000000098859a01000072e4e5516f930000d6679700ff7f0000efbe000000000000d86e9b859a010000005c9e859a010000d86e9b859a010000000000000000000098f09d859a010000c8b238d099000000b49d6afdfe7f000090e69b859a010000d6679700ff7f0000ffffffff0000000080279e859a010000000000000000000000000000000000000100000000000000000000000000000060ef9d859a0100009c966bfdfe7f000000499d859a0100000c00000000000000080000000000000031d451fefe7f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00003704) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a9700ff7f0000000098859a01000000000000000000000000000000000000000098859a01000072e4e5516f930000d6679700ff7f0000efbe000000000000d86e9b859a01000050349e859a010000d86e9b859a0100000000000000000000288f9e859a010000c8b238d099000000b49d6afdfe7f000090e69b859a010000d6679700ff7f0000ffffffff00000000102e9e859a0100000000000000000000000000000000000001000000000000000000000000000000f08d9e859a0100009c966bfdfe7f000000499d859a0100000c00000000000000080000000000000031d451fefe7f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00003704) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a9700ff7f0000000098859a01000000000000000000000000000000000000000098859a01000072e4e5516f930000d6679700ff7f0000efbe000000000000d86e9b859a01000050349e859a010000d86e9b859a0100000000000000000000a8579e859a010000c8b238d099000000b49d6afdfe7f000090e69b859a010000d6679700ff7f0000ffffffff00000000a02a9e859a010000000000000000000000000000000000000100000000000000000000000000000070569e859a0100009c966bfdfe7f000000499d859a0100000c00000000000000080000000000000031d451fefe7f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00003704) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a9700ff7f0000000098859a01000000000000000000000000000000000000000098859a01000072e4e5516f930000d6679700ff7f0000efbe000000000000d86e9b859a01000050349e859a010000d86e9b859a0100000000000000000000288f9e859a010000c8b238d099000000b49d6afdfe7f000090e69b859a010000d6679700ff7f0000ffffffff0000000080319e859a0100000000000000000000000000000000000001000000000000000000000000000000f08d9e859a0100009c966bfdfe7f000000499d859a0100000c00000000000000080000000000000031d451fefe7f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00003704)30:T7c3,"explorer.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "")31:T8ef,"powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003704-00000C17-1814450517 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003704-00000C17-1814471782 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003704-00000C17-1814476032 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00003704-00000C17-1817735695 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00003704-00000C17-1818182479 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00003704-00000C17-1818737878 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003704-00000C17-1819067642 "powershell.exe" queries volume information of "C:\share" at 00000000-00003704-00000C17-1819069306 "powershell.exe" queries volume information of "C:\share" at 00000000-00003704-00000C17-1819160177 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00003704-00000C17-1820644741 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00003704-00000C17-1820790072 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00003704-00000C17-1820833794 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00003704-00000C17-182095377732:T52a6,"powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\diasymreader.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003704) "powershell.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00003704) "explorer.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\ece80f2e3752a779e894fd45d8f27e64\System.Drawing.ni.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\b138f79dea860272ebe6694d9b73f656\System.Windows.Forms.ni.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\fb4ba4db52ca77687f807bb068871ec2\Microsoft.VisualBasic.ni.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005468) "explorer.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005468)33:T11ab2,"powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisibleW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCPW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfo (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfoW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CreateMutex (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CryptAcquireContext (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CryptContextAddRef (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CryptDuplicateKey (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CryptSetKeyParam (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CryptDecrypt (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter WldpIsDynamicCodePolicyEnabled (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptor (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CreateDirectory (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CreateDirectoryA (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandleW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentStrings (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter FreeEnvironmentStrings (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CreateProcess (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter VirtualProtectEx (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CreateRemoteThread (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter SetNamedSecurityInfo (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter SetNamedSecurityInfoA (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter RemoveDirectory (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter RemoveDirectoryW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00003704) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00003704) "explorer.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CLRCreateInstance (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter WldpIsDynamicCodePolicyEnabled (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetComputerName (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter RasEnumConnections (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter RasEnumConnectionsW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter RasConnectionNotification (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter RasConnectionNotificationW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter WinHttpOpenW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter WinHttpCloseHandleW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter WinHttpSetTimeoutsW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter SysAllocStringLen (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter SysAllocStringLenW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter SysFreeString (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter RtlZeroMemory (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter SystemFunction041 (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter SystemFunction041W (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrlW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter select (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter EnumerateSecurityPackagesW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter FreeCredentialsHandle (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter DeleteSecurityContext (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter InitializeSecurityContextW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter QueryContextAttributesW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CertDuplicateStore (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CertDuplicateStoreW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStore (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStoreW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CertOpenStoreW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStore (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStoreW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CertGetCertificateChainW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChain (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChainW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicyW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter EncryptMessage (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter DecryptMessage (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter ZeroMemory (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter ZeroMemoryA (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CryptUnprotectData (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CryptUnprotectDataW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter IdnToAscii (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter IdnToAsciiW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter SystemFunction040 (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter SystemFunction040W (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CreateSemaphore (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CreateSemaphoreA (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CreateMutex (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter shutdown (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter SetWindowLongPtr (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter SetWindowLongPtrW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetWindowLongPtr (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetWindowLongPtrW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CoRegisterMessageFilter (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter PeekMessage (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter WaitMessage (UID: 00000000-00005468) "explorer.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005468)34:T1733,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135]35:T3282,"powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffefcdf0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffefcdf0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffefcdf0000 "powershell.exe" loaded module "KERNEL32" at base 7ffefe3f0000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffee5450000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffefb2e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ffefd5d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPRESOLVER.DLL" at base 7ffee7210000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ffefe3f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffef9420000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7fff00350000 "powershell.exe" loaded module "NTDLL.DLL" at base 7fff00950000 "powershell.exe" loaded module "CSCAPI.DLL" at base 7ffeef8b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffefd500000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ffefdfa0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffedc580000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 19a873a0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffefcd30000 "powershell.exe" loaded module "VERSION.DLL" at base 7ffef4700000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffed7900000 "powershell.exe" loaded module "USER32.DLL" at base 7ffefe9c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffefcdf0000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffee54c0000 "powershell.exe" loaded module "NTDLL" at base 7fff00950000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffefff90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ffecf7d0000 "powershell.exe" loaded module "OLE32.DLL" at base 7ffefe510000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffefff90000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ffefe2b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ffeceb60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ffece0e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffedc410000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffefc140000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffecc070000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ffefff90000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffefff90000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ffefe380000 "powershell.exe" loaded module "SHELL32.DLL" at base 19a87bb0000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ffefd060000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ffefd060000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffefd330000 "powershell.exe" loaded module "AMSI.DLL" at base 7ffee7e10000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffef4700000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffee7df0000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ffefd330000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\H43W3GRN.DLL" at base 7ffedcde0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffedc370000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffed7790000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ffecb700000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffecb590000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffecb220000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffeca970000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ffedcce0000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffefcdf0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffeca820000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffedbe10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffed76b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffeca6e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffedc020000 "powershell.exe" loaded module "SECUR32.DLL" at base 7ffef4200000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ffefcba0000 "powershell.exe" loaded module "WLDP.DLL" at base 7ffefbd00000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffeca600000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffefe3f0000 "powershell.exe" loaded module "USERENV.DLL" at base 7ffefcbd0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffefdfa0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ffefff90000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DIASYMREADER.DLL" at base 7ffeca490000 "powershell.exe" loaded module "GDI32.DLL" at base 7ffefde20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffec9780000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffedcaa0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ffec9540000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ffefc800000 "powershell.exe" loaded module "ADVAPI32" at base 7ffefdfa0000 "explorer.exe" loaded module "SHELL32.DLL" at base 7ffefeb50000 "explorer.exe" loaded module "%WINDIR%\TEMP\VXSSL64.DLL" at base 7ffee19e0000 "explorer.exe" loaded module "MSCOREE.DLL" at base 7ffee54c0000 "explorer.exe" loaded module "AMSI.DLL" at base 7ffee7e10000 "explorer.exe" loaded module "ADVAPI32.DLL" at base 7ffefdfa0000 "explorer.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffefcdf0000 "explorer.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffefcdf0000 "explorer.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffefcdf0000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffedc580000 "explorer.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffefcd30000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffed7900000 "explorer.exe" loaded module "USER32.DLL" at base 7ffefe9c0000 "explorer.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffefcdf0000 "explorer.exe" loaded module "SHLWAPI.DLL" at base 7ffefe390000 "explorer.exe" loaded module "NTDLL" at base 7fff00950000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffefff90000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ffecf7d0000 "explorer.exe" loaded module "OLE32.DLL" at base 7ffefe510000 "explorer.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffefff90000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffefc140000 "explorer.exe" loaded module "KERNEL32.DLL" at base 7ffefe3f0000 "explorer.exe" loaded module "OLEAUT32.DLL" at base 7ffefe2b0000 "explorer.exe" loaded module "WLDP.DLL" at base 7ffefbd00000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffef4700000 "explorer.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffee7df0000 "explorer.exe" loaded module "KERNEL32" at base 7ffefe3f0000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\H43W3GRN.DLL" at base 7ffedcde0000 "explorer.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffefcdf0000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffeca820000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ffeceb60000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\ECE80F2E3752A779E894FD45D8F27E64\SYSTEM.DRAWING.NI.DLL" at base 7ffec9340000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\B138F79DEA860272EBE6694D9B73F656\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 7ffec8290000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ffece0e0000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.V9921E851#\FB4BA4DB52CA77687F807BB068871EC2\MICROSOFT.VISUALBASIC.NI.DLL" at base 7ffed76d0000 "explorer.exe" loaded module "NTDLL.DLL" at base 7fff00950000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffef1b00000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffecd830000 "explorer.exe" loaded module "BCRYPT.DLL" at base 7ffefc800000 "explorer.exe" loaded module "RASAPI32.DLL" at base 7ffef15b0000 "explorer.exe" loaded module "RASMAN.DLL" at base 7ffef1570000 "explorer.exe" loaded module "WS2_32.DLL" at base 7ffefe4a0000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffefc530000 "explorer.exe" loaded module "WINHTTP.DLL" at base 7ffef9340000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffedf400000 "explorer.exe" loaded module "PSAPI.DLL" at base 4990000 "explorer.exe" loaded module "IPHLPAPI.DLL" at base 7ffefc2c0000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffef5500000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffef5be0000 "explorer.exe" loaded module "SECUR32.DLL" at base 7ffef4200000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ffefc080000 "explorer.exe" loaded module "SSPICLI.DLL" at base 7ffefcba0000 "explorer.exe" loaded module "MSKEYPROTECT.DLL" at base 7ffeec4d0000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ffeee530000 "explorer.exe" loaded module "CRYPT32.DLL" at base 7ffefd330000 "explorer.exe" loaded module "OLEAUT32" at base 7ffefe2b0000 "explorer.exe" loaded module "VERSION.DLL" at base 7ffef4700000 "explorer.exe" loaded module "GDI32.DLL" at base 7ffefde2000036:T7d7,"powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "Custom Destination List" (Path: "HKCU\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}") "powershell.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "powershell.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "powershell.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "powershell.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "powershell.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "powershell.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "powershell.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "powershell.exe" touched "Property Store over folder final" (Path: "HKCU\CLSID\{0340F119-A598-4ED9-B0AC-6F6A12D3E755}\TREATAS") "powershell.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "powershell.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "powershell.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS") "powershell.exe" touched "Known Folder Manager" (Path: "HKCU\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "explorer.exe" touched "Ptype_PSFactory" (Path: "HKCU\CLSID\{11659A23-5884-4D1B-9CF6-67D6F4F90B36}")37:T494,Observed system executable string:"CFSFAppDataRoamingMICROS~1WindowsfLhGSTARTM~1ProgramsWINDOW~1WINDOW~1.LNKC:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnkdesktop-fvvf82a'KPv'KPv1SPS1SPS/C:\WindowsSystem32\)2.WINDOW~1=K$uv1.0m=K$u.=Kgm powershell_ise.exe=Kgm=Kgm.C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exedesktop-fvvf82a'KPv'KPv1SPS1SPS/C:\WindowsSystem32\)2.WINDOW~1=K$uv1.0m=K$u.=Kgm powershell_ise.exe=Kgm=Kgm.C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exedesktop-fvvf82a'KPv'KPv1SPS1SPS" [Source: DKBO0OVM794NY7A1Y6M4.temp] Observed system executable string:"%WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe" [Source: 00000000-00003704-00000C2E-2686223832] Observed system executable string:""%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"%TEMP%\kbcc41lv\kbcc" [Source: 00000000-00003704-00000C47-22695737031]38:T1361,Process "csc.exe" (UID: 00000000-00000796) was launched with new environment variables: "computername="DESKTOP-FVVF82A", programw6432="C:\Program Files", commonprogramfiles="%PROGRAMFILES%\Common Files", homedrive="C:", pathext=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL", path="C:\ProgramData\Oracle\Java\javapath;%WINDIR%\system32;%WINDIR%\%WINDIR%\System32\Wbem;%WINDIR%\System32\WindowsPowerShell\v1.0\;%APPDATA%\nvm;C:\Program Files\nodejs;%APPDATA%\nvm;C:\Program Files\nodejs", comspec="%WINDIR%\system32\cmd.exe", homepath="\Users\%OSUSER%", sessionname="Console", tmp="%LOCALAPPDATA%\Temp", processor_revision="4f00", localappdata="%USERPROFILE%\AppData\Local", sslkeylogfile="%TEMP%\sslkey.txt", curl_ca_bundle="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", userprofile="C:\Users\%OSUSER%", number_of_processors="8", programfiles="C:\Program Files", processor_level="6", userdnsdomain="DESKTOP-FVVF82A", userdomain_roamingprofile="DESKTOP-FVVF82A", commonprogramfiles(x86)="%PROGRAMFILES%\(x86)\Common Files", processor_architecture="AMD64", processor_identifier="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", logonserver="%HOSTNAME%", nvm_symlink="%PROGRAMFILES%\nodejs", systemroot="C:\WINDOWS", userdomain="DESKTOP-FVVF82A", commonprogramw6432="%PROGRAMFILES%\Common Files", allusersprofile="C:\ProgramData", public="C:\Users\Public", temp="%LOCALAPPDATA%\Temp", os="Windows_NT", programdata="C:\ProgramData", nvm_home="%APPDATA%\nvm", programfiles(x86)="%PROGRAMFILES%\(x86)", psmodulepath="C:\Users\%OSUSER%\Documents\WindowsPowerShell\Modules;%PROGRAMFILES%\WindowsPowerShell\Modules;%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", onedrive="%USERPROFILE%\OneDrive", prompt="$P$G", _clrrestrictsecattributes="1", systemdrive="C:", appdata="%USERPROFILE%\AppData\Roaming", username="%OSUSER%"" Process "csc.exe" (UID: 00000000-00000796) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, SystemDrive, USERNAME, ProgramFiles(x86), CURL_CA_BUNDLE, PATHEXT, PROCESSOR_ARCHITEW6432, ProgramData, ProgramW6432, HOMEPATH, PROCESSOR_IDENTIFIER, ProgramFiles, PUBLIC, LOCALAPPDATA, USERDOMAIN, LOGONSERVER, PROMPT, OneDrive, APPDATA, CommonProgramFiles, Path, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, SystemRoot, TEMP, HOMEDRIVE, USERPROFILE, TMP, CommonProgramFiles(x86), NUMBER_OF_PROCESSORS" Process "explorer.exe" (UID: 00000000-00005468) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", SystemDrive="C:", USERNAME="%OSUSER%", USERDNSDOMAIN="DESKTOP-FVVF82A", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\%OSUSER%", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", LOCALAPPDATA="%USERPROFILE%\AppData\Local", USERDOMAIN="DESKTOP-FVVF82A", LOGONSERVER="%HOSTNAME%", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", CommonProgramFiles="%PROGRAMFILES%\Common Files", Path="C:\ProgramData\Oracle\Java\javapath;%WINDIR%\system32;%WINDIR%\%WINDIR%\System32\Wbem;%WINDIR%\System32\WindowsPowerShell\v1.0\;%NVM_HOME%;%NVM_SYMLINK%;%APPDATA%\nvm;C:\Program Files\nodejs", OS="Windows_NT", COMPUTERNAME="DESKTOP-FVVF82A", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", SystemRoot="C:\WINDOWS", TEMP="%LOCALAPPDATA%\Temp", HOMEDRIVE="C:", USERPROFILE="C:\Users\%OSUSER%", TMP="%LOCALAPPDATA%\Temp", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", NUMBER_OF_PROCESSORS="2"" Process "explorer.exe" (UID: 00000000-00005468) was launched with missing environment variables: "computername, programw6432, commonprogramfiles, homedrive, pathext, path, comspec, homepath, sessionname, tmp, processor_revision, localappdata, sslkeylogfile, curl_ca_bundle, userprofile, number_of_processors, programfiles, processor_level, userdnsdomain, userdomain_roamingprofile, commonprogramfiles(x86), processor_architecture, processor_identifier, logonserver, nvm_symlink, systemroot, userdomain, commonprogramw6432, allusersprofile, public, temp, os, programdata, nvm_home, programfiles(x86), psmodulepath, onedrive, prompt, _clrrestrictsecattributes, systemdrive, appdata, username"39:T4da,"powershell.exe" reads file "C:\Users\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Links\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Saved Games\desktop.ini"3a:T1386,Observed system executable string:"C:\> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\HAPUBWS\AppData\Local\Temp\kbcc41lv\kbcc41lv.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\HAPUBWS\AppData\Local\Temp\kbcc41lv\kbcc41lv.0.cs"Microsoft (R) Visual C# Compiler version 4.8.3761.0for C# 5Copyright (C) Microsoft Corporation. All rights reserved.This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240" [Source: kbcc41lv.out] Observed system executable string:"/t:library /utf8output /R:"System.dll" /R:"C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\HAPUBWS\AppData\Local\Temp\kbcc41lv\kbcc41lv.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\HAPUBWS\AppData\Local\Temp\kbcc41lv\kbcc41lv.0.cs"" [Source: kbcc41lv.cmdline] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00003704-00000C2B-1814976008] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00003704-00000C2B-1815407081] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00003704-00000C2B-1815514012] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00003704-00000C2B-1815625557] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00003704-00000C2B-1815768725] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00003704-00000C2B-1815835083] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00003704-00000C2B-1815897250] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00003704-00000C2B-1815961869] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00003704-00000C2B-1816058837] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00003704-00000C2B-1816101491] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00003704-00000C2B-1816172391] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00003704-00000C2B-1816399688] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00003704-00000C2B-1816492157] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00003704-00000C2B-1816686990] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00003704-00000C2B-1816704410] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00003704-00000C2B-1816889560] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00003704-00000C2B-1817038595] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00003704-00000C2B-1817220796] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00003704-00000C2B-1817327043] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00003704-00000C2B-1817358292] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00003704-00000C2B-1817465156] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00003704-00000C2B-1817660400] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00003704-00000C2B-1817830986]3b:T653,The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: EE:B6:DB:C4:31:72:08:57:B9:E2:AC:B5:70:6C:98:1E:2C:71:76:BD; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication CA DV R36, O=Sectigo Limited, C=GB" (SHA1: C3:3E:55:28:66:9B:C4:5E:63:36:9A:CF:1F:E7:66:D6:73:97:7A:95; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication Root R46, O=Sectigo Limited, C=GB" (SHA1: DD:55:B4:52:02:91:E2:76:58:8F:0D:D0:2F:AF:D8:3A:73:68:E0:FA; see report for more information) The input sample is signed with a certificate issued by "CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US" (SHA1: 2B:18:94:7A:6A:9F:C7:76:4F:D8:B5:FB:18:A8:63:B0:C6:DA:C2:4F; see report for more information) The input sample is signed with a certificate issued by "CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US" (SHA1: 2B:8F:1B:57:33:0D:BB:A2:D0:7A:6C:51:F7:0E:E9:0D:DA:B9:AD:8E; see report for more information)3c:Tc63,"powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\crypt32" (Filter: 268435460; Subtree: 0) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\Root" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\FlightRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\CA" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config" (Filter: 268435461; Subtree: 1)3d:T7ff,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\ENVIRONMENT"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\POWERSHELL"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\POWERSHELL"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\POWERSHELL\1\SHELLIDS\MICROSOFT.POWERSHELL"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\POWERSHELL\1\SHELLIDS\MICROSOFT.POWERSHELL"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS DEFENDER"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\REMOVALTOOLS\MRT"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\POLICY MANAGER"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: ""; Value: "")3e:Tacb,"powershell.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "EA9E8155-5042-5537-0B73-8C0E6B53F398"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\ENVIRONMENT"; Key: "__PSLOCKDOWNPOLICY"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "EBA789D9-533B-58D4-CD1F-2E6520E3A9C2"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\POWERSHELL\1\SHELLIDS\MICROSOFT.POWERSHELL"; Key: "EXECUTIONPOLICY"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "DB30E9DC-354D-48B5-9DC0-AEAEBC5C6B54"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "E4B70372-261F-4C54-8FA6-A5A7914D73DA"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS DEFENDER"; Key: "PRODUCTAPPDATAPATH"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\REMOVALTOOLS\MRT"; Key: "GUID"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON"; Key: "USERENVDEBUGLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: "GPSVCDEBUGLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT"; Key: "ENABLEREMOTEMANAGEDDEFAULTS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER"; Key: "DISABLELOCALADMINMERGE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER"; Key: "PRODUCTGUID"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS DEFENDER"; Key: "PRODUCTGUID"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER"; Key: "BETAPLATFORM"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS DEFENDER"; Key: "BETAPLATFORM"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS DEFENDER"; Key: "INSTALLLOCATION"; Value: "")3f:T459,"powershell.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms" "powershell.exe" reads file "c:\windows\system32\windowspowershell\v1.0\powershell.exe.config" "powershell.exe" reads file "c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.pb378ec07#\b5ba37e1558ced178a99011a1d659b52\microsoft.powershell.consolehost.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system\e43dd9c73ab5615e461bf5109c3facd6\system.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.core\0d59b0e237d7519417de10cd84bda4e7\system.core.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\system.management.automation.ni.dll.aux"40:T4f9,"powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DKBO0OVM794NY7A1Y6M4.temp" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF2ae766.TMP" "powershell.exe" touched file "C:\Windows\System32\CatRoot" "powershell.exe" touched file "C:\Windows\System32\catroot2" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\DKBO0OVM794NY7A1Y6M4.temp" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF2ae766.TMP" "powershell.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive"41:Ta2a,"powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\LINKINFO.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\LINKINFO.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\NTSHRUI.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\ntshrui.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\SSPICLI.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\SspiCli.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\SRVCLI.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\srvcli.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CSCAPI.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\cscapi.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll"42:T8a0,"powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\DESKTOP.INI" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DKBO0OVM794NY7A1Y6M4.TEMP" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DKBO0OVM794NY7A1Y6M4.temp" "powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" "powershell.exe" trying to access non-existent file "Z:\" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\SYSTEM.MANAGEMENT.AUTOMATION.PDB" "powershell.exe" trying to access non-existent file "C:\Windows\SYSTEM.MANAGEMENT.AUTOMATION.PDB" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.CORE.PDB" "powershell.exe" trying to access non-existent file "C:\Windows\SYSTEM.CORE.PDB"43:T559,"powershell.exe" writes file "\device\namedpipe\srvsvc" "powershell.exe" writes file "c:\users\%osuser%\appdata\roaming\microsoft\windows\recent\customdestinations\dkbo0ovm794ny7a1y6m4.temp" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_gxmhfp2g.h0l.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_pcvhuspa.jgp.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\kbcc41lv\kbcc41lv.0.cs" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\kbcc41lv\kbcc41lv.cmdline" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\kbcc41lv\kbcc41lv.out" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive" "powershell.exe" writes file "%appdata%\microsoft\windows\recent\customdestinations\dkbo0ovm794ny7a1y6m4.temp" "powershell.exe" writes file "%temp%\__psscriptpolicytest_gxmhfp2g.h0l.ps1" "powershell.exe" writes file "%temp%\__psscriptpolicytest_pcvhuspa.jgp.psm1" "powershell.exe" writes file "%temp%\kbcc41lv\kbcc41lv.0.cs" "powershell.exe" writes file "%temp%\kbcc41lv\kbcc41lv.cmdline" "powershell.exe" writes file "%localappdata%\microsoft\windows\powershell\startupprofiledata-noninteractive" "csc.exe" writes file "%temp%\kbcc41lv\kbcc41lv.out"44:T8d6,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe (UID: 00000000-00003704) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00003704) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00003704) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003704) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00003704) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00003704) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00003704) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00003704) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00003704) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00003704) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00003704) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00003704) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00003704) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00003704) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00003704) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00003704) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00003704) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00003704) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00003704) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00003704)45:T4b7,file/memory contains long string with (Indicator: "base64"; File: "8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin") file/memory contains long string with (Indicator: "FromBase64String"; File: "8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin") file/memory contains long string with (Indicator: "aes"; File: "8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin") file/memory contains long string with (Indicator: "createdecryptor"; File: "8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin") Found string "$TelescopeThing = [Security.Cryptography.Aes]::Create()" (Indicator: "aes"; File: "8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin") Found string "$Telescopefront = $TelescopeThing.CreateDecryptor().TransformFinalBlock($c, 0, $c.Length)" (Indicator: "createdecryptor"; File: "8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin") Found string ""System.Security.Cryptography.CipherMode"." (Indicator: "System.Security.Cryptography"; File: "screen_3.png") Found string ""System.Security.Cryptography.PaddingMode”." (Indicator: "System.Security.Cryptography"; File: "screen_3.png")46:T5be,"powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DKBO0OVM794NY7A1Y6M4.temp" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF2ae766.TMP" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_gxmhfp2g.h0l.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_pcvhuspa.jgp.psm1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\kbcc41lv\kbcc41lv.0.cs" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\kbcc41lv\kbcc41lv.dll" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\kbcc41lv\KBCC41LV.PDB" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\kbcc41lv\kbcc41lv.cmdline" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\kbcc41lv\kbcc41lv.tmp" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\kbcc41lv\kbcc41lv.err" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\kbcc41lv\kbcc41lv.out" with delete access47:Tafd,"powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CSC.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "explorer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "")48:T9fa,"powershell.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "explorer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\EXPLORER_RASAPI32"; Key: "ENABLEFILETRACING"; Value: "0000000000") "explorer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\EXPLORER_RASAPI32"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "explorer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\EXPLORER_RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "explorer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\EXPLORER_RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "explorer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\EXPLORER_RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "explorer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\EXPLORER_RASAPI32"; Key: "MAXFILESIZE"; Value: "0000100000") "explorer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\EXPLORER_RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "explorer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\EXPLORER_RASMANCS"; Key: "ENABLEFILETRACING"; Value: "0000000000") "explorer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\EXPLORER_RASMANCS"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "explorer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\EXPLORER_RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "explorer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\EXPLORER_RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "explorer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\EXPLORER_RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "explorer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\EXPLORER_RASMANCS"; Key: "MAXFILESIZE"; Value: "0000100000") "explorer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\EXPLORER_RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "explorer.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "explorer.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\APPLICATIONVIEWMANAGEMENT\W32:0000000000040338"; Key: "VIRTUALDESKTOP"; Value: "10000000303044560000000000000000000000000000000000")49:T95b,"GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Thu 23 Apr 2026 23:18:14 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org" Response ==> HTTP/1.1 200 OK Date: Thu 23 Apr 2026 23:18:15 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET /xml/64.124.12.162 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Thu 23 Apr 2026 23:18:15 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Server: cloudflare Age: 75602 Accept-Ranges: bytes last-modified: Thu 23 Apr 2026 02:18:13 GMT Cache-Control: max-age=31536000 cf-cache-status: HIT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=s8ALtwX4iFdIK%2Fr%2FRsh%2BOlUjuatgNs%2FjWBgLWVhYf7f37EzMg8RLmeX%2FzPXaFTic0eHnmHFfY3cZn%2BYExKotCKcnK5l1nZ2Ok64KouYGdTkqQb2Pn0%2FHH5YJpHNJpHHWWGwTG%2B32"}]} CF-RAY: 9f10961d6eaa2ed1-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C526573706F6E73653E0A093C49503E36342E3132342E31322E3136323C2F49503E0A093C436F756E747279436F64653E55533C2F436F756E747279436F6465....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org" Response ==> HTTP/1.1 200 OK Date: Thu 23 Apr 2026 23:18:21 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420.......4a:T110d,"explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TORCH\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COCCOC\BROWSER\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TENCENT\QQBROWSER\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\XVAST\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\QIP SURF\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BLISK\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\NICHROME\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\KOMETA\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\SUPERBIRD\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA STABLE\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CENTBROWSER\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHEDOT\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BLACKHAWK\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CATALINAGROUP\CITRIO\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\UCOZMEDIA\URAN\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\SPUTNIK\SPUTNIK\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\MAPLESTUDIO\CHROMEPLUS\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\CHROME SXS\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\FENRIR INC\SLEIPNIR5\SETTING\MODULES\CHROMIUMVIEWER\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\KINZA\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\AMIGO\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\EPIC PRIVACY BROWSER\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\360BROWSER\BROWSER\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\360CHROME\CHROME\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\VIVALDI\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\XPOM\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\ORBITUM\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\IRIDIUM\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\7STAR\7STAR\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data" "explorer.exe" trying to open a file "%LOCALAPPDATA%\TORCH\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "%LOCALAPPDATA%\COCCOC\BROWSER\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "%LOCALAPPDATA%\TENCENT\QQBROWSER\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "%LOCALAPPDATA%\XVAST\USER DATA\DEFAULT\LOGIN DATA"4b:T1580,"explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS MESSAGING SUBSYSTEM\PROFILES\9375CFF0413111D3B88A00104B2A6676") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "EMAIL") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "IMAP PASSWORD") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "POP3 PASSWORD") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "HTTP PASSWORD") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "SMTP PASSWORD") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "EMAIL") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "IMAP PASSWORD") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "POP3 PASSWORD") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "HTTP PASSWORD") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "SMTP PASSWORD") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003"; Key: "EMAIL") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003"; Key: "IMAP PASSWORD") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003"; Key: "POP3 PASSWORD") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003"; Key: "HTTP PASSWORD") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003"; Key: "SMTP PASSWORD") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "EMAIL") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "IMAP PASSWORD") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "POP3 PASSWORD") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "HTTP PASSWORD") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "SMTP PASSWORD") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "EMAIL") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "IMAP PASSWORD") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "POP3 PASSWORD") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "HTTP PASSWORD") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "SMTP PASSWORD")4c:T113b,"explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TORCH\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TORCH\USER DATA\DEFAULT" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COCCOC\BROWSER\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COCCOC\BROWSER\USER DATA\DEFAULT" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TENCENT\QQBROWSER\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TENCENT\QQBROWSER\USER DATA\DEFAULT" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\XVAST\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\XVAST\USER DATA\DEFAULT" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\QIP SURF\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\QIP SURF\USER DATA\DEFAULT" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Local State" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA\DEFAULT" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BLISK\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BLISK\USER DATA\DEFAULT" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA\DEFAULT" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\NICHROME\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\NICHROME\USER DATA\DEFAULT" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\KOMETA\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\KOMETA\USER DATA\DEFAULT" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\SUPERBIRD\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\SUPERBIRD\USER DATA\DEFAULT" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA STABLE\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\OPERA\OPERA\PROFILE\WAND.DAT" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\OPERA\OPERA\PROFILE" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA\DEFAULT" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CENTBROWSER\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CENTBROWSER\USER DATA\DEFAULT" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHEDOT\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHEDOT\USER DATA\DEFAULT" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\GHOSTBROWSER\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\GHOSTBROWSER\USER DATA\DEFAULT" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\UCBROWSER\USER DATA_I18N\DEFAULT\UC LOGIN DATA.18" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\UCBROWSER\USER DATA_I18N\DEFAULT" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BLACKHAWK\USER DATA\DEFAULT\LOGIN DATA" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BLACKHAWK\USER DATA\DEFAULT" "explorer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CATALINAGROUP\CITRIO\USER DATA\DEFAULT\LOGIN DATA"4d:T7f4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAFvElEQVR4XuWWeWxTdQCATTwQlfin0WhiDBoiJmict4kaJ3KJAaJoVGK2ZDpYxCMcATUDowYUNjYQHOI2kLGxju6AdetYz/XYunZX1x1sUOiOdl3pGGu3tWOf720uo90Nf/pLvvyaNHnf9977vd97d9zx37DZbNwuJpOJ+Ph4xo45pyEeYHh4eFJu3LgxDUMMDY3S0tKCQqEgNjZ27hGTB4TLwhmXi3R1daHVatHr9URHR88tYmJAuCycUPkYZrOZtrY2jEYjMTExs48IDQiXhYqnkg8NBbFYLAQCAdxuN+Xl5cTFxc0uYixgonDmsxbFIsFgcOTy+3w++vr6cDgclJSUEBUVNXOEGDBRODe5SH5+PtnZ2WRlZY0glUqRyWS3GxAunVw+SmAE8Xji7VAqlRQVFd1qwPT3O1Q8LhfXwDiDWK3WWwkIF0531lPLxwj3TRihAeHS25MPDs4pIFw6nXxUPJN8DgHh0nG5tKCQUq2eUo0OuUCxSodMrSNfUYa0VCvM2pE5p0RLtlzLKbmak8VqTsjUpMuU/HW2lJRCDbsTD08eIwZMJhZxCVuspKAIX2CI60PgDQ7jDQxT6/ZhbL9GmaOHis5emq4JC87Tj8Xtp9zVh67jOuq2a5y/7EUlIGnsYvOuX2cbMH7JdXojxUYLTn8AlSdIkXuQc90BvjO2cabFg9HZxyclrXxtdrOz3ss3tVeJsXTzuamLTw0drFNf4YeKdv4wNPNZzKbZBITe7wKZHHWDnTrvIFLXIKfa+0lv62d7VRcJ1Z0IFwRFey+v59QTZfawwdTNBwYXazUdrFFc5p3CFn4yOth/Tseq1WumC5hsoQX5R5KH5qKTYpeflCt+Dlz0sbelj611XpbLWtlr6WTgxjApVicRuU2s0Dl5V+kgstjOm2cv8EqOjZ0aO7tTJUQuWzZ9QLhcXMkpmTkoWl0cu9zHzxeus6Ohl68F+UaBT4UzfjKjjiMNboTlwR5zOwsljTyT28zCLCuPpVexKK2SqLONbNxzmKVLl04dEC4XHy/xhXJQWoysyUl8Uy+b63v4otrLBkG81uRhcaGd1wovUur00TYQ5KuKDu5ONrAgtYb7/zQxL0nPoj+NfCSpYsOWeN77aIrvhNCA0Wd7YKAfXbmJRLmBVOHyxtb2sL7Sw3JDN0vkbdx33Mp6tYPaawGULh8vZtYIcj33JOp4IKWSBYcM3LtPzXNHhW+DDC1rN0SzatWqmQLGN5be3uvkFMjYq6rje7OTSJ2bJSoXj+Rd4tEMK8mtvTj8QX4su8Tzf1fw0D4ljydpeOA3JfMTtDyYqGX+r+eJSDEQe6yQtyKnuPziGA0I3dU8Hg8pWXnsKLWxWt3BEyWdPFzUwV2Si7x6tgVNt5+VebaRs4wraUIuPOvSZjfz95Ry5x4l8wT5vF2FPJ2sJTopk4iIl2YOuHlLtdoa+P1ENgkqK3F6Bx9rL7NOZWel8My/caaOF7KqePl0NcvONbKywMbyMzVEnqokIknOijQNa04a+SC9jHXHDXz20yGeff7F6QPC9/NcuYLkkznYL9npdbu46uwcwevqpKfLiVfYIXuE3011NZjLDVgqyqkxm6gzGSnKz6VCX8bVdjtVtmbWf/kti56NmE3A+IvkUGYux3JlNAn/2ZsbaGlsoHWMpkYuNTdTX11NXo6EjBNpZJ48Tr40h6vCrTuQmMDpUxmYytScU+qJfP9D7lmwYKaA0LfY3swC0otUKIStWKEzUFpmFBBnEf3IXKzSojGYMJqrMFRWCbMFlUbLackZausb0ZdXcji7kJfeeHtquThuDhh7hX6XeJQtB9PYfuQEW/84ztZD6QJpbD0oksq2ZBHh/6S/2XbgmMBfbEs4yje/JLJ9/xGBFHYmpbJp1z6eWrR45oAx8SgDIQwMiPRPoL9fxD8lfr+Ib3q5OEIDwsW3J59DwGRnfavyUfGsA/63419VriCx/9vdmwAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791844833127,"unified_at":"2026-10-12T22:40:33.127Z","metadata":{"hashes":{"sha256":"8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3","sha1":"a39ba6a303bf9c4572ba7805da130f8154b4c623","md5":"1ef594b3aef471993f5dc88be710e980","sha512":"cf4a512180432872b5e3b8bb6087ee6a265d72effb386b96f7850ced7eaf812dda6c95d58220df072660ad8b2a723e0f59e477535151606eca4f8cf6dad8a276","ssdeep":"3072:w0lYT8Y6qq22jDrlCQ3NYAqpL0iA7kNODveXuWBlHxPrJuk/RSssTszXZ6u9JPkf:h1qq2WPYcqAqpQ3tD6uWBlHxPre+puaW","ssdeep_chunks":["3072:w0lYT8Y","3072:0lYT8Y6","3072:lYT8Y6q","3072:YT8Y6qq","3072:T8Y6qq2","3072:8Y6qq22","3072:Y6qq22j","3072:6qq22jD","3072:qq22jDr","3072:q22jDrl","3072:22jDrlC","3072:2jDrlCQ","3072:jDrlCQ3","3072:DrlCQ3N","3072:rlCQ3NY","3072:lCQ3NYA","3072:CQ3NYAq","3072:Q3NYAqp","3072:3NYAqpL","3072:NYAqpL0","3072:YAqpL0i","3072:AqpL0iA","3072:qpL0iA7","3072:pL0iA7k","3072:L0iA7kN","3072:0iA7kNO","3072:iA7kNOD","3072:A7kNODv","3072:7kNODve","3072:kNODveX","3072:NODveXu","3072:ODveXuW","3072:DveXuWB","3072:veXuWBl","3072:eXuWBlH","3072:XuWBlHx","3072:uWBlHxP","3072:WBlHxPr","3072:BlHxPrJ","3072:lHxPrJu","3072:HxPrJuk","3072:xPrJuk/","3072:PrJuk/R","3072:rJuk/RS","3072:Juk/RSs","3072:uk/RSss","3072:k/RSssT","3072:/RSssTs","3072:RSssTsz","3072:SssTszX","3072:ssTszXZ","3072:sTszXZ6","3072:TszXZ6u","3072:szXZ6u9","3072:zXZ6u9J","3072:XZ6u9JP","3072:Z6u9JPk","3072:6u9JPkf","6144:w0lYT8Y","6144:0lYT8Y6","6144:lYT8Y6q","6144:YT8Y6qq","6144:T8Y6qq2","6144:8Y6qq22","6144:Y6qq22j","6144:6qq22jD","6144:qq22jDr","6144:q22jDrl","6144:22jDrlC","6144:2jDrlCQ","6144:jDrlCQ3","6144:DrlCQ3N","6144:rlCQ3NY","6144:lCQ3NYA","6144:CQ3NYAq","6144:Q3NYAqp","6144:3NYAqpL","6144:NYAqpL0","6144:YAqpL0i","6144:AqpL0iA","6144:qpL0iA7","6144:pL0iA7k","6144:L0iA7kN","6144:0iA7kNO","6144:iA7kNOD","6144:A7kNODv","6144:7kNODve","6144:kNODveX","6144:NODveXu","6144:ODveXuW","6144:DveXuWB","6144:veXuWBl","6144:eXuWBlH","6144:XuWBlHx","6144:uWBlHxP","6144:WBlHxPr","6144:BlHxPrJ","6144:lHxPrJu","6144:HxPrJuk","6144:xPrJuk/","6144:PrJuk/R","6144:rJuk/RS","6144:Juk/RSs","6144:uk/RSss","6144:k/RSssT","6144:/RSssTs","6144:RSssTsz","6144:SssTszX","6144:ssTszXZ","6144:sTszXZ6","6144:TszXZ6u","6144:szXZ6u9","6144:zXZ6u9J","6144:XZ6u9JP","6144:Z6u9JPk","6144:6u9JPkf","3072:h1qq2WP","3072:1qq2WPY","3072:qq2WPYc","3072:q2WPYcq","3072:2WPYcqA","3072:WPYcqAq","3072:PYcqAqp","3072:YcqAqpQ","3072:cqAqpQ3","3072:qAqpQ3t","3072:AqpQ3tD","3072:qpQ3tD6","3072:pQ3tD6u","3072:Q3tD6uW","3072:3tD6uWB","3072:tD6uWBl","3072:D6uWBlH","3072:6uWBlHx","3072:BlHxPre","3072:lHxPre+","3072:HxPre+p","3072:xPre+pu","3072:Pre+pua","3072:re+puaW"],"imphash":"Unknown"},"file_info":{"file_name":"lady.ps1","file_type":["powershell","ps"],"file_type_id":"ps1","file_size":170557,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1776055563000,"last_seen":1776986235000,"last_multi_scan":1776986235000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["opensource","loader","donut"]},"stats":{"av":{"malicious_count":4,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":61},"sandbox_signatures":{"informative_count":139,"suspicious_count":12,"malicious_count":9,"total":160},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"DR/SNH","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"CMD:Heur.BZC.PZQ.Boxter.441.E2161A1D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"CMD:Heur.BZC.PZQ.Boxter.441.E2161A1D (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"PowerShell/TrojanDropper.Agent.BBI trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"CMD:BZC.PZQ.Boxter.441","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"IP Addresses","attack_id":"T1590.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1590/005","identifiers":[{"type":"suspicious","value":"Able to evade execution by checking for blacklisted external IPs"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Recently renewed or created SSL certificate"},{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Scripts code detected via AMSI (Antimalware Scan Interface)"},{"type":"informative","value":"Executes a PowerShell script"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to create a process"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Injects into remote processes"},{"type":"malicious","value":"Injects into explorer"},{"type":"malicious","value":"Windows system process connects to a network"},{"type":"suspicious","value":"Writes data to a remote process"},{"type":"suspicious","value":"Calls an API typically used to create a thread in another process"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to create a remote thread (API string)"},{"type":"suspicious","value":"Script loads executable in memory (Antimalware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Calls an API typically used to decrypt the data"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Calls an API typically used to acquire handle to a key container within a CSP"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Detected XOR operators (encryption/decryption)"},{"type":"informative","value":"Script contains XOR (Antimalware Scan Interface)"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Calls an API typically used to decrypt data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Opens file with deletion access rights"},{"type":"informative","value":"Marks file for deletion"},{"type":"informative","value":"Calls an API typically used to remove a directory"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Defense Evasion","technique":"Compile After Delivery","attack_id":"T1027.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/004","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"malicious","value":"Attempts to obtain browser login credentials (file access)"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Opens a handle to the specified process"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Contains ability to retrieve processes (Powershell command string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Able to enumerate system processes using native API"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access recent files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Tries to access Powershell profile file"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Attempts to identify external IP address"},{"type":"informative","value":"Detected Suricata Alert - External IP Lookup"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"malicious","value":"Reads the windows product ID"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Accesses software policy settings"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"suspicious","value":"Checks on FTP client related files"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"suspicious","value":"Reads FTP client related files"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"malicious","value":"Tries to steal Mail credentials from registry"},{"type":"suspicious","value":"Tries to access mail clients information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Contains reference to Mail transfer protocol"},{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Calls an API typically used to import asymmetric cryptographic keys into a CSP"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"GETs files from a web server"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Calls an API typically used to import cryptographic keys into a CSP"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"file/memory contains long string with (Indicator: \"VirtualAllocEx\"; File: \"8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin\")\n file/memory contains long string with (Indicator: \"VirtualAllocEx\"; File: \"kbcc41lv.0.cs\")\n Found reference to API \"[DllImport(\"kernel32\", EntryPoint=\"VirtualAllocEx\")]\" (Indicator: \"VirtualAllocEx\"; File: \"8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"file/memory contains long string with (Indicator: \"CreateRemoteThread\"; File: \"8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin\")\n file/memory contains long string with (Indicator: \"CreateRemoteThread\"; File: \"kbcc41lv.0.cs\")\n Found reference to API \"[DllImport(\"kernel32\", EntryPoint=\"CreateRemoteThread\")]\" (Indicator: \"CreateRemoteThread\"; File: \"8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00003704)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00003704)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00003704)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00003704)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '1763240902657', 'hResInfo': '1763240903904'}\" (UID: 00000000-00003704)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1763240902657', 'hResInfo': '1763240903936'}\" (UID: 00000000-00003704)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1763240902657', 'hResInfo': '1763240903952'}\" (UID: 00000000-00003704)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1763240902657', 'hResInfo': '1763240903920'}\" (UID: 00000000-00003704)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"powershell.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\kbcc41lv (UID: 00000000-00003704)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"file/memory contains long string with (Indicator: \"CreateRemoteThread\"; File: \"8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin\")\n file/memory contains long string with (Indicator: \"CreateRemoteThread\"; File: \"kbcc41lv.0.cs\")\n Found reference to API \"[DllImport(\"kernel32\", EntryPoint=\"CreateRemoteThread\")]\" (Indicator: \"CreateRemoteThread\"; File: \"8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution (Powershell command string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-397","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"RC2\"; File: \"8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin\")\n file/memory contains long string with (Indicator: \"Aes\"; File: \"8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin\")\n Found reference to \"$TelescopeThing = [Security.Cryptography.Aes]::Create()\" (Indicator: \"Aes\"; File: \"8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin\")\n Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00005468-00000BC0-1835801294\")\n Found reference to \"SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00005468-00000CC3-1848501992\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$27","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$28","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Script contains XOR (Antimalware Scan Interface)","description":"The script contains XOR encryption - bxor","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1027","relevance":10,"id":"amsi-5","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Scripts code detected via AMSI (Antimalware Scan Interface)","description":"details too long to display","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1059.001","relevance":5,"id":"amsi-2","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)","description":"Process \"powershell.exe\" executed suspicious script","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1059","relevance":3,"id":"amsi-0","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 3704)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00005468-00000C2C-1839771935\")\n Found reference to API \"CryptUnprotectDataW\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00005468-00000C2C-1839771969\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"file/memory contains long string with (Indicator: \"CreateDecryptor\"; File: \"8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin\")\n Found reference to API \"$Telescopefront = $TelescopeThing.CreateDecryptor().TransformFinalBlock($c, 0, $c.Length)\" (Indicator: \"CreateDecryptor\"; File: \"8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to acquire handle to a key container within a CSP","description":"$29","origin":"API Call","mitre_attack_id":"T1027","relevance":1,"id":"api-228","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to decrypt data","description":"$2a","origin":"API Call","mitre_attack_id":"T1140","relevance":1,"id":"api-232","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to import asymmetric cryptographic keys into a CSP","description":"$2b","origin":"API Call","mitre_attack_id":"T1573.002","relevance":1,"id":"api-234","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to import cryptographic keys into a CSP","description":"$2c","origin":"API Call","mitre_attack_id":"T1486","relevance":1,"id":"api-233","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Cryptographic Related","name":"Detected XOR operators (encryption/decryption)","description":"file/memory contains long string with (Indicator: \"-bxor \"; File: \"8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin\")\n Found string \"$TelescopeCOUNSELOR[$i] = $temp[$i] -bxor $video\" (Indicator: \"-bxor \"; File: \"8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin\")\n Found string \"$c[$i] = $c[$i] -bxor $k\" (Indicator: \"-bxor \"; File: \"8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2d","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Detected XOR operators (encryption/decryption)\n Matched sigs: Script contains XOR (Antimalware Scan Interface)\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2e","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Detected XOR operators (encryption/decryption)\n Matched sigs: Script contains XOR (Antimalware Scan Interface)","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003704-00000C2C-1816624850\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003704-00000C2C-1817261937\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003704-00000C2C-1816624850\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003704-00000C2C-1817261937\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00003704-00000C2C-1815624458\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00003704-00000C2C-1815624909\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003704-00000C2C-1817638508\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003704-00000C2C-1817638549\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00005468-00000C2C-1837075270\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00003704-00000C2C-1817002638\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00003704-00000C2C-1817002663\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"powershell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00003704)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"powershell.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00003704)\n \"powershell.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00003704)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"powershell.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003704)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"powershell.exe\" called \"IsWow64Process\" with parameter \"3704\" - (UID: 00000000-00003704)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00003704)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003704)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2f","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f00000200000000004f004c00450030004400330034003100330031003700390042004200370043003700390031003800440037004100340036003600420032004200380042005d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003704)\n \"explorer.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000000000000000000 (UID: 00000000-00005468)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00003704)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00003704)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00003704)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$30","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$31","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"explorer.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"DONTUSEDESKTOPCHANGEROUTER\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to access recent files","description":"\"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\DKBO0OVM794NY7A1Y6M4.TEMP\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\DKBO0OVM794NY7A1Y6M4.temp\"\n \"powershell.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF2ae766.TMP\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-169","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO External IP Lookup Service Domain (reallyfreegeoip .org) in TLS SNI\" (SID: 2051431, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert - External IP Lookup","description":"Detected alert \"ET INFO External IP Lookup - checkip.dyndns.org\" (SID: 2021378, Rev: 8, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"\n Detected alert \"ET INFO 404/Snake/Matiex Keylogger Style External IP Check\" (SID: 2039190, Rev: 5, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"\n Detected alert \"ET INFO External IP Lookup Service Domain (reallyfreegeoip .org) in TLS SNI\" (SID: 2051431, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","mitre_attack_id":"T1016","relevance":3,"id":"suricata-4","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\27748148BBE67A43CDBFEC6C3784862CE134E6EA\"; Key: \"BLOB\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"General","name":"Accesses software policy settings","description":"\"explorer.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\"; Key: \"DD55B4520291E276588F0DD02FAFD83A7368E0FA\")\n \"explorer.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"DD55B4520291E276588F0DD02FAFD83A7368E0FA\")\n \"explorer.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\"; Key: \"2B18947A6A9FC7764FD8B5FB18A863B0C6DAC24F\")\n \"explorer.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"2B18947A6A9FC7764FD8B5FB18A863B0C6DAC24F\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00003704)\n \"explorer.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00005468)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"powershell.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\kbcc41lv (UID: 00000000-00003704)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"powershell.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"%TEMP%\\kbcc41lv\\kbcc\" - (UID: 00000000-00003704)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134214850683170316.3704.DefaultAppDomain.powershell\" - (UID: 00000000-00003704)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$32","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$33","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"checkip.dyndns.org\"\n \"reallyfreegeoip.org\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process powershell.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:3704:304:WilStaging_02\"\n Process powershell.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3704:304:WilStaging_02\"\n Process powershell.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:3704:120:WilError_01\"\n Process powershell.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3704:120:WilError_01\"\n Process powershell.exe created mutex with name \"SM0:3704:304:WilStaging_02\"\n Process powershell.exe created mutex with name \"Local\\SM0:3704:120:WilError_01\"\n Process powershell.exe created mutex with name \"SM0:3704:120:WilError_01\"\n Process powershell.exe created mutex with name \"Local\\SM0:3704:304:WilStaging_02\"\n Process powershell.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"General","name":"Executes a PowerShell script","description":"Process \"powershell.exe\" with commandline \"-f \"C:\\\\8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin.ps1\"\" (UID: 00000000-00003704)","origin":"Monitored Target","mitre_attack_id":"T1059.001","id":"target-401","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$34","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134214850683170316.3704.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$35","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at CF7D0000\n \"explorer.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at CF7D0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at E7E10000\n \"explorer.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at E7E10000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at FD500000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at FC800000\n \"csc.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at FD500000\n \"csc.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at FC800000\n \"cvtres.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at FC800000\n \"cvtres.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at FD500000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at D7900000\n \"csc.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at D7900000\n \"explorer.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at D7900000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 00350000\n \"csc.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 00350000\n \"cvtres.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 00350000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c7f6fcfe7f0000@ntdll.dll\"\n \"220023000000000018c7f6fcfe7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin\" was detected as \"plain text\" and name: \"Format\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"file/memory contains long string with (Indicator: \"New-Object\"; File: \"8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin\")\n file/memory contains long string with (Indicator: \"powershell_ise.exe\"; File: \"DKBO0OVM794NY7A1Y6M4.temp\")\n Found string \"New-Object System.Threading.Mutex($false, $YOUNG) | Out-Null\" (Indicator: \"New-Object\"; File: \"8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin\")\n Found string \"$TelescopeCOUNSELOR = New-Object byte[] $temp.Length\" (Indicator: \"New-Object\"; File: \"8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$36","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$37","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$38","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"checkip.dyndns.org\"\n \"reallyfreegeoip.org\"\n \"smtp.hostinger.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"General","name":"Reads configuration files (.ini files)","description":"$39","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\USER PROFILE\"; Key: \"LANGUAGES\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\GEO\"; Key: \"NATION\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"explorer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"explorer.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"csc.exe\" with commandline \"/noconfig /fullpaths @\"%TEMP%\\\\kbcc41lv\\\\kbcc41lv.cmdline\"\" (UID: 00000000-00000796)\n Spawned process \"cvtres.exe\" with commandline \"/NOLOGO /READONLY /MACHINE:IX86 \"/OUT:%TEMP%\\\\RES7EE.tmp\" \"%TEMP ...\" (UID: 00000000-00006020)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"csc.exe\" with commandline \"/noconfig /fullpaths @\"%TEMP%\\\\kbcc41lv\\\\kbcc41lv.cmdline\"\" (UID: 00000000-00000796)\n Spawned process \"cvtres.exe\" with commandline \"/NOLOGO /READONLY /MACHINE:IX86 \"/OUT:%TEMP%\\\\RES7EE.tmp\" \"%TEMP ...\" (UID: 00000000-00006020)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$3b","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_gxmhfp2g.h0l.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_pcvhuspa.jgp.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\kbcc41lv\\kbcc41lv.0.cs\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\kbcc41lv\\kbcc41lv.cmdline\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\kbcc41lv\\kbcc41lv.out\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/modify Windows services (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Add-Type\"; File: \"8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin\")\n Found string \"Add-Type -TypeDefinition $code\" (Indicator: \"Add-Type\"; File: \"8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-396","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"kbcc41lv.out\" has type \"Unicode text UTF-8 (with BOM) text with very long lines (433) with CRLF CR line terminators\"- Location: [%TEMP%\\kbcc41lv\\kbcc41lv.out]- [targetUID: 00000000-00000796]\n \"kbcc41lv.0.cs\" has type \"Unicode text UTF-8 (with BOM) text\"- Location: [%TEMP%\\kbcc41lv\\kbcc41lv.0.cs]- [targetUID: 00000000-00003704]\n \"kbcc41lv.cmdline\" has type \"Unicode text UTF-8 (with BOM) text with very long lines (370) with no line terminators\"- Location: [%TEMP%\\kbcc41lv\\kbcc41lv.cmdline]- [targetUID: 00000000-00003704]\n \"StartupProfileData-NonInteractive\" has type \"data\"- Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00003704]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"$3c","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens a handle to the specified process","description":"\"powershell.exe\" opens a process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 00000000-00003704)\n \"powershell.exe\" opens a process \"C:\\Windows\\explorer.exe\" (UID: 00000000-00003704)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-237","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"powershell.exe\" queries basic process information of the \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 3704)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$3f","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution (Powershell command string)\n Matched sigs: Reference to an external IP address lookup service identified\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Attempts to identify external IP address","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\ATL.DLL\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\atl.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MSCOREE.DLL\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\mscoree.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\powershell.exe.mui\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\ole32.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\oleaut32.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FLTLIB.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$40","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"powershell.exe\" trying to access LNK file \"C:\\%AppData%\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk\"\n \"powershell.exe\" trying to access LNK file \"C:\\Windows\\%APPDATA%\\MICROSOFT\\WINDOWS\\START MENU\\PROGRAMS\\WINDOWS POWERSHELL\\WINDOWS POWERSHELL.LNK\"\n \"powershell.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk\"\n \"powershell.exe\" trying to access LNK file \"%WINDIR%\\%APPDATA%\\MICROSOFT\\WINDOWS\\START MENU\\PROGRAMS\\WINDOWS POWERSHELL\\WINDOWS POWERSHELL.LNK\"\n \"powershell.exe\" trying to access LNK file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$41","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$42","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$43","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00005468-00000C2C-1836873572\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /\"\n Found http requests in header \"GET /xml/64.124.12.162\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00005468-00000C2C-1836873459\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00005468-00000C2C-1836916025\")\n Found reference to API \"WinHttpOpenW\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00005468-00000C2C-1836916049\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"file/memory contains long string with (Indicator: \"smtp\"; File: \"8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin\")","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-499","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00005468-00000C2C-1836873459\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"smtp.hostinger.com\" [Source: PCAP]\n Observed email domain:\"250-smtp.hostinger.com250-pipelining250-size 48811212250-etrn250-auth plain login250-enhancedstatuscodes250-8bitmime250-dsn250 chunking\" [Source: 00000000-00005468-00000CBE-1846351426]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"64.124.12.162\" found in string \"/xml/64.124.12.162\"\n Potential IP \"64.124.12.162\" found in string \"GET /xml/64.124.12.162 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive\"\n \"2.5.29.37\"\n \"2.5.29.35\"\n Potential IP \"64.124.12.162\" found in string \"64.124.12.162USUnited StatesMIMichiganOkemos48864America/Detroit: Client host rejected: Access denied\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://go.microsoft.com/fwlink/?linkid=533240\"\n Heuristic match: \"$telescopeflat = $p[0].id\"\n Heuristic match: \"checkip.dyndns.org\"\n Heuristic match: \"get / http/1.1user-agent: mozilla/4.0 (compatible; msie 6.0; windows nt 5.2; .net clr1.0.3705;)host: checkip.dyndns.org\"\n Heuristic match: \"reallyfreegeoip.org\"\n Heuristic match: \"smtp.hostinger.com\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET / HTTP/1.1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)\nHost: checkip.dyndns.org\nConnection: Keep-Alive\n\n GET / HTTP/1.1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)\nHost: checkip.dyndns.org\n\n GET /xml/64.124.12.162 HTTP/1.1\nHost: reallyfreegeoip.org\nConnection: Keep-Alive\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"checkip.dyndns.org\" has high entropy\n Contacted domain: \"smtp.hostinger.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c\n Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"reallyfreegeoip.org\" (8 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://reallyfreegeoip.org/xml/64.124.12.162","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"reallyfreegeoip.org\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$44","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00003704)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00003704)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00003704)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00003704)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$45","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve processes (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Get-Process\"; File: \"8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin\")\n Found string \"$p = Get-Process -Name (\"rerolpxe\"[-1..-8] -join \"\") -ErrorAction SilentlyContinue\" (Indicator: \"Get-Process\"; File: \"8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-291","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"System Destruction","name":"Marks file for deletion","description":"\"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF2ae766.TMP\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_gxmhfp2g.h0l.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_pcvhuspa.jgp.psm1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\kbcc41lv\\kbcc41lv.0.cs\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\kbcc41lv\\kbcc41lv.dll\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\kbcc41lv\\kbcc41lv.cmdline\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\kbcc41lv\\kbcc41lv.tmp\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\kbcc41lv\\kbcc41lv.err\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\kbcc41lv\\kbcc41lv.out\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"System Destruction","name":"Opens file with deletion access rights","description":"$46","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003704)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00005468-00000C2C-1848502193","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"explorer.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"System Security","name":"Modifies Software Policy Settings","description":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"powershell.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$47","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$48","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to redirect output to specified device/utility (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Out-Null\"; File: \"8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin\")\n Found string \"[System.Threading.Mutex]::OpenExisting($YOUNG) | Out-Null\" (Indicator: \"Out-Null\"; File: \"8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin\")\n Found string \"New-Object System.Threading.Mutex($false, $YOUNG) | Out-Null\" (Indicator: \"Out-Null\"; File: \"8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin\")\n Found string \"[recruit]::Ukzb3B1KYTWyFLp($TelescopeDRAMATIC, $Telescopeproposed, $Telescopefront, [uint32]$Telescopefront.Length, [IntPtr]::Zero) | Out-Null\" (Indicator: \"Out-Null\"; File: \"8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin\")\n Found string \"[recruit]::qykjPBi02GyC($TelescopeDRAMATIC, $Telescopeproposed, [uint32]$Telescopefront.Length, 0x20, [ref]$o) | Out-Null\" (Indicator: \"Out-Null\"; File: \"8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin\")","origin":"File/Memory","relevance":1,"id":"string-373","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"& { Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.ErrorCategory_Message }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.OriginInfo }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"DKBO0OVM794NY7A1Y6M4.temp\" - Location: [%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\DKBO0OVM794NY7A1Y6M4.temp]- [targetUID: 00000000-00003704]\n Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00003704]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"explorer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to create a thread in another process","description":"\"powershell.exe\" called \"CreateRemoteThread\" with parameters {\"hProcess\": \"2256\"\n \"lpThreadAttributes\": \"0\"\n \"dwStackSize\": \"0\"\n \"lpStartAddress\": \"40828928\"\n \"lpParameter\": \"0\"\n \"dwCreationFlags\": \"0\"\n \"lpThreadId\": \"0\"}","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-106","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Script loads executable in memory (Antimalware Scan Interface)","description":"Executable loaded in memory \"MZ@\t!L!This program cannot be run in DOS mode.\n\n$PELui!.% @ @$S@` H.text4 `.rsrc@@@.reloc`@B%HX (\n*BSJBv4.0.30319l#~`#Strings#US#GUIDp#BlobG\t%3\n/(* 6\n G X\t h$ v/P 99=!9)B\t9.G.P=FRa\tt!kbcc41lv.dllrecruitmscorlibSystemObjectsoa80ORViOU2es3uM08MzpUmY3PwsJIpUkzb3B1KYTWyFLpvAI888N0FmRYuqykjPBi02GyC.ctorabcdefgSystem.Runtime.InteropServicesOutAttributeSystem.Runtime.CompilerServicesCompilationRelaxationsAttributeRuntimeCompatibilityAttributekbcc41lvDllImportAttributekernel32OpenProcessVirtualAllocExWriteProcessMemoryCreateRemoteThreadVirtualProtectEx -L1 Nz\\V4\t\t\t\t\t\t\n\t\t\t\t\t\t TWrapNonExceptionThrows%% %_CorDllMainmscoree.dll% 0HX@LL4VS_VERSION_INFO?DVarFileInfo$TranslationStringFileInfo000004b0,FileDescription 0FileVersion0.0.0.0<\nInternalNamekbcc41lv.dll(LegalCopyright D\nOriginalFilenamekbcc41lv.dll4ProductVersion0.0.0.08Assembly Version0.0.0.0 05\"","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1055.001","relevance":10,"id":"amsi-3","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Uses a Windows Living Off The Land Binaries (LOL bins)","description":"Process \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" launched with commandline \"/noconfig /fullpaths @\"%TEMP%\\\\kbcc41lv\\\\kbcc41lv.cmdline\"\" (UID: 00000000-00000796)\n Process \"%WINDIR%\\explorer.exe\" launched with commandline \"\" (UID: 00000000-00005468)","origin":"Monitored Target","relevance":3,"id":"target-411","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"suspicious","category":"Environment Awareness","name":"Able to evade execution by checking for blacklisted external IPs","description":"Found string \"64.124.12.162USUnited StatesMIMichiganOkemos48864America/Detroit: Client host rejected: Access denied\" (Indicator: \"64.124.12.162\"; Source: \"00000000-00005468-00000CBE-1848495284\")","origin":"File/Memory","mitre_attack_id":"T1590.005","relevance":1,"id":"string-643","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"4/27 Antivirus vendors marked sample as malicious (14% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"suspicious","category":"General","name":"GETs files from a web server","description":"$49","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-61","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"powershell.exe\" wrote 00000FB8 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" (Handle: 2320)\n \"powershell.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" (Handle: 2320)\n \"powershell.exe\" wrote 0001E84B bytes to a remote process \"C:\\Windows\\explorer.exe\" (Handle: 2256)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to decrypt the data","description":"\"explorer.exe\" called \"CryptUnprotectData\" with parameters {\"pDataIn\": \"2201000000000000587d421300000000\"\n \"pDataOut\": \"2000000000000000e0c82a1000000000\"\n \"$dataout\": \"0f4aa5c0c11d58716120296fb1f18a9f9f745b820146ae89377b10f6e86376a7\"}","origin":"API Call","mitre_attack_id":"T1027","relevance":5,"id":"api-172","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Checks on FTP client related files","description":"\"explorer.exe\" opened file \"C:\\Users\\%OSUSER%\\AppData\\Local\\NICHROME\\USER DATA\\DEFAULT\\LOGIN DATA\"\n \"explorer.exe\" opened file \"C:\\Users\\%OSUSER%\\AppData\\Local\\NICHROME\\USER DATA\\DEFAULT\"\n \"explorer.exe\" opened file \"C:\\Users\\%OSUSER%\\AppData\\Local\\MAPLESTUDIO\\CHROMEPLUS\\USER DATA\\DEFAULT\\LOGIN DATA\"\n \"explorer.exe\" opened file \"C:\\Users\\%OSUSER%\\AppData\\Local\\MAPLESTUDIO\\CHROMEPLUS\\USER DATA\\DEFAULT\"\n \"explorer.exe\" opened file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\FILEZILLA\\RECENTSERVERS.XML\"\n \"explorer.exe\" opened file \"%LOCALAPPDATA%\\NICHROME\\USER DATA\\DEFAULT\\LOGIN DATA\"\n \"explorer.exe\" opened file \"%LOCALAPPDATA%\\NICHROME\\USER DATA\\DEFAULT\"\n \"explorer.exe\" opened file \"%LOCALAPPDATA%\\MAPLESTUDIO\\CHROMEPLUS\\USER DATA\\DEFAULT\\LOGIN DATA\"\n \"explorer.exe\" opened file \"%LOCALAPPDATA%\\MAPLESTUDIO\\CHROMEPLUS\\USER DATA\\DEFAULT\"\n \"explorer.exe\" opened file \"%APPDATA%\\FILEZILLA\\RECENTSERVERS.XML\"","origin":"API Call","mitre_attack_id":"T1005","relevance":8,"id":"api-45","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Reads FTP client related files","description":"\"explorer.exe\" read 40960 bytes from file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\"","origin":"API Call","mitre_attack_id":"T1119","relevance":10,"id":"api-44","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access mail clients information (file access)","description":"\"explorer.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\THUNDERBIRD\\PROFILES\"\n \"explorer.exe\" trying to open a file \"%APPDATA%\\THUNDERBIRD\\PROFILES\"","origin":"API Call","mitre_attack_id":"T1114","relevance":5,"id":"api-131","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Windows system process connects to a network","description":"Process \"explorer.exe\" connects to 193.122.130.0:80","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":7,"id":"target-269","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the windows product ID","description":"\"explorer.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"DIGITALPRODUCTID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":6,"id":"registry-5","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"malicious","category":"Installation/Persistence","name":"Injects into explorer","description":"Injected into \"explorer.exe\" (UID: 00000000-00005468)","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"malicious","category":"Installation/Persistence","name":"Injects into remote processes","description":"Injected into \"explorer.exe\" at 2026-4-23.23:21:57.233 (UID: 00000000-00005468)","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":6,"id":"target-0","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"malicious","category":"Network Related","name":"Attempts to identify external IP address","description":"\"checkip.dyndns.org\"\n \"reallyfreegeoip.org\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Attempts to obtain browser login credentials (file access)","description":"$4a","origin":"API Call","mitre_attack_id":"T1555.003","relevance":10,"id":"api-281","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Mail credentials from registry","description":"$4b","origin":"Registry Access","mitre_attack_id":"T1114","relevance":3,"id":"registry-37","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$4c","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"name":"Stealer/Phishing","details_count":2,"details":[{"detail":"Reads FTP client related files"},{"detail":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Creates new processes"},{"detail":"Injects into remote processes"},{"detail":"Injects into explorer"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Attempts to identify external IP address"},{"detail":"Tries to steal Mail credentials from registry"},{"detail":"Reads the windows product ID"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":9,"imported_dlls_count":113,"dropped_files_count":0,"extracted_files_count":5,"files_written_count":19,"files_deleted_count":0,"registry_keys_created_count":24,"registry_keys_modified_count":0,"registry_keys_deleted_count":1,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":25,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":3,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["opensource","loader","donut"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"69eaa87a752906694b017b10","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"CMD:Heur.BZC.PZQ.Boxter.441","contacted_countries":["USA"],"submit_name":"8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin","analysis_start_time":"2026-04-23T23:17:15+00:00","indicators_count":{"informative":139,"suspicious":27,"malicious":9},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"checkip.dyndns.org","address":"193.122.130.0","ttl":158,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"domain":"reallyfreegeoip.org","address":"104.21.67.152","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"domain":"smtp.hostinger.com","address":"172.65.255.143","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]}],"http_requests":[{"host":"checkip.dyndns.org","host_ip":"193.122.130.0:80","url":"/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET / HTTP/1.1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)\nHost: checkip.dyndns.org\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"host":"reallyfreegeoip.org","host_ip":"104.21.67.152:443","url":"/xml/64.124.12.162","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /xml/64.124.12.162 HTTP/1.1\nHost: reallyfreegeoip.org\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}],"processes":[{"pid":3704,"ppid":0,"name":"powershell.exe","command_line":"-f \"C:\\8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3.bin.ps1\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe","uid":"00000000-00003704","icon":"$4d"},{"pid":796,"ppid":3704,"name":"csc.exe","command_line":"/noconfig /fullpaths @\"%TEMP%\\kbcc41lv\\kbcc41lv.cmdline\"","sha256":"4240a12e0b246c9d69af1f697488fe7da1b497df20f4a6f95135b4d5fe180a57","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","parent_uid":"00000000-00003704","uid":"00000000-00000796"},{"pid":6020,"ppid":796,"name":"cvtres.exe","command_line":"/NOLOGO /READONLY /MACHINE:IX86 \"/OUT:%TEMP%\\RES7EE.tmp\" \"%TEMP%\\kbcc41lv\\CSCBA2D0503B5644CF5AD2878C4B79C3C88.TMP\"","sha256":"1fe531eac592b480aa4bd16052b909c3431434f17e7ae163d248355558ce43a6","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","parent_uid":"00000000-00000796","uid":"00000000-00006020"},{"pid":5468,"ppid":3704,"name":"explorer.exe","command_line":"","sha256":"107060bab6d8dff0fdf91777f84453b8336fdc4c30ca189ab9d58e8801c9e924","normalized_path":"%WINDIR%\\explorer.exe","parent_uid":"00000000-00003704","uid":"00000000-00005468"}],"all_imported_dlls":["gdi32.dll","cfgmgr32.dll","cryptbase.dll","ncryptsslp.dll","ucrtbase.dll","win32u.dll","kernel.appcore.dll","propsys.dll","wintrust.dll","cscapi.dll","fltLib.dll","powrprof.dll","amsi.dll","mskeyprotect.dll","windows.storage.dll","vcruntime140_clr0400.dll","System.Transactions.ni.dll","secur32.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","schannel.dll","rasadhlp.dll","bcrypt.dll","msvcp110_win.dll","ntdll.dll","rpcrt4.dll","System.Data.dll","imm32.dll","ws2_32.dll","mswsock.dll","dpapi.dll","shlwapi.dll","Microsoft.Management.Infrastructure.ni.dll","System.Configuration.ni.dll","imagehlp.dll","H43w3GrN.dll","AppResolver.dll","Microsoft.PowerShell.Security.ni.dll","sechost.dll","mscoreei.dll","kernel32.dll","SHCore.dll","psapi.dll","FWPUCLNT.DLL","combase.dll","linkinfo.dll","atl.dll","mscoree.dll","ntshrui.dll","version.dll","mscorlib.ni.dll","wldp.dll","slc.dll","policymanager.dll","gpapi.dll","System.Xml.ni.dll","cldapi.dll","gdi32full.dll","userenv.dll","System.Numerics.ni.dll","rtutils.dll","msvcp_win.dll","ole32.dll","urlmon.dll","System.Data.ni.dll","ELSCore.dll","srvcli.dll","System.Management.ni.dll","System.Drawing.ni.dll","System.Core.ni.dll","dnsapi.dll","profapi.dll","ucrtbase_clr0400.dll","alink.dll","winnsi.dll","bcryptprimitives.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","System.Management.Automation.ni.dll","ntmarta.dll","sspicli.dll","diasymreader.dll","System.Windows.Forms.ni.dll","System.ni.dll","MpOAV.dll","clrjit.dll","sppc.dll","netutils.dll","clr.dll","KernelBase.dll","msvcrt.dll","oleaut32.dll","BCP47Langs.dll","Microsoft.PowerShell.Commands.Management.ni.dll","clbcatq.dll","crypt32.dll","System.DirectoryServices.ni.dll","MpClient.dll","shell32.dll","rsaenh.dll","msasn1.dll","OnDemandConnRouteHelper.dll","Microsoft.VisualBasic.ni.dll","rasman.dll","cryptsp.dll","user32.dll","VxSSL64.dll","System.Transactions.dll","System.Configuration.Install.ni.dll","mscorpehost.dll","rasapi32.dll","advapi32.dll","uxtheme.dll","iertutil.dll","aepic.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"kbcc41lv.cmdline","sha256":"8319d512cee45ab7ad1f5d4baa1290cb8e271af9126ec6640d52357264797c66","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"name":"DKBO0OVM794NY7A1Y6M4.temp","sha256":"02158ae9d62abfe588c90a02c16332ffbb1e4c52fdade35bbd6a99ff9b27004c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"name":"kbcc41lv.0.cs","sha256":"9bdfc5970c6a05832892834a3d98a4b9fd42514c77c61ebf804b0454d50337d6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"name":"kbcc41lv.out","sha256":"589df4b7e9f085594475b9e7ff51e4c43614dd6bbd3a3c18bc4b15821940b13b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\DKBO0OVM794NY7A1Y6M4.temp","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF2ae766.TMP","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_gxmhfp2g.h0l.ps1","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_pcvhuspa.jgp.psm1","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"path":"%TEMP%\\kbcc41lv\\kbcc41lv.tmp","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"path":"%TEMP%\\kbcc41lv\\kbcc41lv.0.cs","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"path":"%TEMP%\\kbcc41lv\\kbcc41lv.dll","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"path":"%TEMP%\\kbcc41lv\\kbcc41lv.cmdline","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"path":"%TEMP%\\kbcc41lv\\kbcc41lv.out","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"path":"%TEMP%\\kbcc41lv\\kbcc41lv.err","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\TRACING\\EXPLORER_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\TRACING\\EXPLORER_RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\SESSIONINFO\\1\\APPLICATIONVIEWMANAGEMENT\\W32:0000000000040338\\","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3704:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3704:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3704:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3704:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"name":"SM0:3704:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"name":"Local\\SM0:3704:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"name":"SM0:3704:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"name":"Local\\SM0:3704:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\","sources":[{"report_type":"sandbox","report_id":"69eaa87a752906694b017b10"}]}]}},"report_ids":{"sandbox_job_ids":["69eaa87a752906694b017b10"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious CMD:BZC.PZQ.Boxter.441 Sample 8b4713d64064… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 8b4713d64064…. Malware family: CMD:BZC.PZQ.Boxter.441. Threat score 100/100. 4/27 AV engines flagged this file. 9 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3"}],["$","meta","4",{"property":"og:title","content":"Malicious CMD:BZC.PZQ.Boxter.441 Sample 8b4713d64064… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 8b4713d64064…. Malware family: CMD:BZC.PZQ.Boxter.441. Threat score 100/100. 4/27 AV engines flagged this file. 9 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/8b4713d64064a656f25bf59544c509b8a7d5ab45568ce94445fbabbdc34364b3"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious CMD:BZC.PZQ.Boxter.441 Sample 8b4713d64064… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 8b4713d64064…. Malware family: CMD:BZC.PZQ.Boxter.441. Threat score 100/100. 4/27 AV engines flagged this file. 9 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4e","11",{}]]