26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 5d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4db,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_70% Sample 9a2476c64747… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 9a2476c64747…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 2/27 AV engines flagged this file. 9 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9a2476c6474745cfacee35d15a3d4034d8d254304be3fa17a170ec0af9f9077e","keywords":["Malicious","Win/malicious_confidence_70%","malware analysis","sandbox report","threat intelligence","9a2476c6474745cfacee35d15a3d4034d8d254304be3fa17a170ec0af9f9077e"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable","compressed","sfx","64bits","rar"],"identifier":"9a2476c6474745cfacee35d15a3d4034d8d254304be3fa17a170ec0af9f9077e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_70%","antivirusDetections":{"malicious":2,"total":27},"behavioralIndicators":{"malicious":9,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tcc2,file/memory contains long string with (Indicator: "Export-ModuleMember"; File: "AMSI") Found string "elWrapper.EndProcessing() } } catch { throw } } # .EXTERNALHELP MSFT_MpWDOScan.cdxml-Help.xml}Microsoft.PowerShell.Core\Export-ModuleMember -Function 'Start-MpWDOScan' -Alias '*'" (Indicator: "Export-ModuleMember"; File: "AMSI") Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "Export-Counter" (Indicator: "Export-Counter"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "ConvertFrom-StringData" (Indicator: "ConvertFrom-StringData"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "ConvertTo-Csv" (Indicator: "ConvertTo-CSV"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "ConvertFrom-Csv" (Indicator: "ConvertFrom-CSV"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "Export-Clixml" (Indicator: "Export-Clixml"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "ConvertTo-Xml" (Indicator: "ConvertTo-Xml"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "ConvertTo-Html" (Indicator: "ConvertTo-Html"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "Export-FormatData" (Indicator: "Export-FormatData"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "ConvertFrom-Json" (Indicator: "ConvertFrom-Json"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "ConvertTo-Json" (Indicator: "ConvertTo-Json"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "ConvertFrom-String" (Indicator: "ConvertFrom-String"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "ConvertFrom-SecureString" (Indicator: "ConvertFrom-SecureString"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "ConvertTo-SecureString" (Indicator: "ConvertTo-SecureString"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp")28:T1703,Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00003208-00000BC0-1184036912") Found reference to "RC2-CBC" (Indicator: "RC2"; Source: "00000000-00000736.00000000.143511.87013000.00000004.mdmp, 00000000-00000736.00000001.145431.87013000.00000004.mdmp, 00000000-00000736.00000002.147350.87013000.00000004.mdmp") Found reference to "AES-128-CBC-HMAC-SHA256" (Indicator: "HMAC"; Source: "00000000-00000736.00000000.143511.87063000.00000004.mdmp, 00000000-00000736.00000001.145431.87063000.00000004.mdmp, 00000000-00000736.00000002.147350.87063000.00000004.mdmp") Found reference to "AES-128-CBC-HMAC-SHA1" (Indicator: "HMAC"; Source: "00000000-00000736.00000000.143511.87063000.00000004.mdmp, 00000000-00000736.00000001.145431.87063000.00000004.mdmp, 00000000-00000736.00000002.147350.87063000.00000004.mdmp") Found reference to "AES-256-CBC-HMAC-SHA1" (Indicator: "HMAC"; Source: "00000000-00000736.00000000.143511.87063000.00000004.mdmp, 00000000-00000736.00000001.145431.87063000.00000004.mdmp, 00000000-00000736.00000002.147350.87063000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00000736.00000000.143511.87063000.00000004.mdmp, 00000000-00000736.00000001.145431.87063000.00000004.mdmp, 00000000-00000736.00000002.147350.87063000.00000004.mdmp") Found reference to "SHA512-256" (Indicator: "SHA512"; Source: "00000000-00000736.00000000.143511.87063000.00000004.mdmp, 00000000-00000736.00000001.145431.87063000.00000004.mdmp, 00000000-00000736.00000002.147350.87063000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00000736.00000000.143511.87063000.00000004.mdmp, 00000000-00000736.00000001.145431.87063000.00000004.mdmp, 00000000-00000736.00000002.147350.87063000.00000004.mdmp") Found reference to "SHA512-224" (Indicator: "SHA512"; Source: "00000000-00000736.00000000.143511.87063000.00000004.mdmp, 00000000-00000736.00000001.145431.87063000.00000004.mdmp, 00000000-00000736.00000002.147350.87063000.00000004.mdmp") Found reference to "HMAC" (Indicator: "HMAC"; Source: "00000000-00000736.00000000.143511.870A2000.00000004.mdmp, 00000000-00000736.00000001.145431.870A2000.00000004.mdmp, 00000000-00000736.00000002.147350.870A2000.00000004.mdmp") Found reference to "AES-256-CBC-HMAC-SHA256" (Indicator: "HMAC"; Source: "00000000-00000736.00000000.143511.870A2000.00000004.mdmp, 00000000-00000736.00000001.145431.870A2000.00000004.mdmp, 00000000-00000736.00000002.147350.870A2000.00000004.mdmp") Found reference to "ecdsa-with-SHA512" (Indicator: "SHA512"; Source: "00000000-00000736.00000000.143511.870A2000.00000004.mdmp, 00000000-00000736.00000001.145431.870A2000.00000004.mdmp, 00000000-00000736.00000002.147350.870A2000.00000004.mdmp") Found reference to "ecdsa-with-SHA384" (Indicator: "SHA384"; Source: "00000000-00000736.00000000.143511.870A2000.00000004.mdmp, 00000000-00000736.00000001.145431.870A2000.00000004.mdmp, 00000000-00000736.00000002.147350.870A2000.00000004.mdmp") Found reference to "DSA-SHA384" (Indicator: "SHA384"; Source: "00000000-00000736.00000000.143511.870A2000.00000004.mdmp, 00000000-00000736.00000001.145431.870A2000.00000004.mdmp, 00000000-00000736.00000002.147350.870A2000.00000004.mdmp") Found reference to "DSA-SHA512" (Indicator: "SHA512"; Source: "00000000-00000736.00000000.143511.870A2000.00000004.mdmp, 00000000-00000736.00000001.145431.870A2000.00000004.mdmp, 00000000-00000736.00000002.147350.870A2000.00000004.mdmp") Found reference to "dsa_with_SHA384" (Indicator: "SHA384"; Source: "00000000-00000736.00000000.143511.870A2000.00000004.mdmp, 00000000-00000736.00000001.145431.870A2000.00000004.mdmp, 00000000-00000736.00000002.147350.870A2000.00000004.mdmp") Found reference to "dsa_with_SHA512" (Indicator: "SHA512"; Source: "00000000-00000736.00000000.143511.870A2000.00000004.mdmp, 00000000-00000736.00000001.145431.870A2000.00000004.mdmp, 00000000-00000736.00000002.147350.870A2000.00000004.mdmp") Found reference to "RSA-SHA512-224" (Indicator: "SHA512"; Source: "00000000-00000736.00000000.143511.870A2000.00000004.mdmp, 00000000-00000736.00000001.145431.870A2000.00000004.mdmp, 00000000-00000736.00000002.147350.870A2000.00000004.mdmp") Found reference to "RSA-SHA384" (Indicator: "SHA384"; Source: "00000000-00000736.00000000.143511.870A2000.00000004.mdmp, 00000000-00000736.00000001.145431.870A2000.00000004.mdmp, 00000000-00000736.00000002.147350.870A2000.00000004.mdmp") Found reference to "RSA-SHA512" (Indicator: "SHA512"; Source: "00000000-00000736.00000000.143511.870A2000.00000004.mdmp, 00000000-00000736.00000001.145431.870A2000.00000004.mdmp, 00000000-00000736.00000002.147350.870A2000.00000004.mdmp") Found reference to "RSA-SHA512-256" (Indicator: "SHA512"; Source: "00000000-00000736.00000000.143511.870A2000.00000004.mdmp, 00000000-00000736.00000001.145431.870A2000.00000004.mdmp, 00000000-00000736.00000002.147350.870A2000.00000004.mdmp") Found reference to "ECDSA-SHA512" (Indicator: "SHA512"; Source: "00000000-00000736.00000000.143511.870A2000.00000004.mdmp, 00000000-00000736.00000001.145431.870A2000.00000004.mdmp, 00000000-00000736.00000002.147350.870A2000.00000004.mdmp") Found reference to "ECDSA-SHA384" (Indicator: "SHA384"; Source: "00000000-00000736.00000000.143511.870A2000.00000004.mdmp, 00000000-00000736.00000001.145431.870A2000.00000004.mdmp, 00000000-00000736.00000002.147350.870A2000.00000004.mdmp") Found reference to "HKDF" (Indicator: "HKDF"; Source: "00000000-00000736.00000000.143511.870A2000.00000004.mdmp, 00000000-00000736.00000001.145431.870A2000.00000004.mdmp, 00000000-00000736.00000002.147350.870A2000.00000004.mdmp") Found reference to "HMAC-DRBG" (Indicator: "HMAC"; Source: "00000000-00000736.00000000.143511.870A2000.00000004.mdmp, 00000000-00000736.00000001.145431.870A2000.00000004.mdmp, 00000000-00000736.00000002.147350.870A2000.00000004.mdmp")29:T8ba,"9iqmgvw,czcinternet1verisign," - Source: "00000000-00003208.00000001.143742.1DA20000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003208.00000001.143742.1DA20000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00003208.00000001.143742.1DA20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fmicrosoft.management.infrastructure.userfilteredexceptionhandlingrefemit_inmemorymanifestmodulemscorlibsystem.diagnosticsdebuggableattributedebuggingmodes.ctorsystem.runtime.compilerservicesruntimecompatibilityattributesystemobjectuserfilteredexceptionhandlingexceptionactioninvokefunc" - Source: "00000000-00003208.00000001.143742.20AA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbr9iqmgvw,czcinternet1verisign," - Source: "00000000-00003208.00000002.145665.1DA20000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003208.00000002.145665.1DA20000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00003208.00000002.145665.1DA20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fmicrosoft.management.infrastructure.userfilteredexceptionhandlingrefemit_inmemorymanifestmodulemscorlibsystem.diagnosticsdebuggableattributedebuggingmodes.ctorsystem.runtime.compilerservicesruntimecompatibilityattributesystemobjectuserfilteredexceptionhandlingexceptionactioninvokefunc" - Source: "00000000-00003208.00000002.145665.20AA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbr" (Indicator: "password"; Source: "00000000-00003208.00000001.143742.20AA0000.00000004.mdmp, 00000000-00003208.00000002.145665.20AA0000.00000004.mdmp")51:T515,Found string "Hostname" (Indicator: "hostname"; Source: "00000000-00000736.00000000.143511.87013000.00000004.mdmp, 00000000-00000736.00000001.145431.87013000.00000004.mdmp, 00000000-00000736.00000002.147350.87013000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "hostname"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "Press Enter to continue...me of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "hostname"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "hostname"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "Hostname" (Indicator: "hostname"; Source: "00000000-00003412.00000000.141887.95F2B000.00000004.mdmp, 00000000-00003412.00000001.143805.95F2B000.00000004.mdmp, 00000000-00003412.00000002.145727.95F2B000.00000004.mdmp")52:Ta1f,Found string "C:\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000736.00000000.143511.87013000.00000004.mdmp, 00000000-00000736.00000001.145431.87013000.00000004.mdmp, 00000000-00000736.00000002.147350.87013000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\Public\svchost.exe" (Indicator: "\Device\"; Source: "00000000-00000736.00000000.143511.87013000.00000004.mdmp, 00000000-00000736.00000001.145431.87013000.00000004.mdmp, 00000000-00000736.00000002.147350.87013000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00003208.00000000.141825.03180000.00000004.mdmp, 00000000-00003208.00000001.143742.03180000.00000004.mdmp, 00000000-00003208.00000002.145665.03180000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003208.00000001.143742.03180000.00000004.mdmp, 00000000-00003208.00000002.145665.03180000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}ic" (Indicator: "\Device\"; Source: "00000000-00003208.00000001.143742.1DA20000.00000004.mdmp, 00000000-00003208.00000002.145665.1DA20000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}ic" (Indicator: "\DosDevices\"; Source: "00000000-00003208.00000001.143742.1DA20000.00000004.mdmp, 00000000-00003208.00000002.145665.1DA20000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\Device\"; Source: "00000000-00003208.00000001.143742.1DA20000.00000004.mdmp, 00000000-00003208.00000002.145665.1DA20000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\DosDevices\"; Source: "00000000-00003208.00000001.143742.1DA20000.00000004.mdmp, 00000000-00003208.00000002.145665.1DA20000.00000004.mdmp") Found string "C:\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003412.00000000.141887.95F13000.00000004.mdmp, 00000000-00003412.00000001.143805.95F13000.00000004.mdmp, 00000000-00003412.00000002.145727.95F13000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\Public\svchost.exe" (Indicator: "\Device\"; Source: "00000000-00003412.00000000.141887.95F13000.00000004.mdmp, 00000000-00003412.00000001.143805.95F13000.00000004.mdmp, 00000000-00003412.00000002.145727.95F13000.00000004.mdmp")53:T5a7,Found string "Remove-Module" (Indicator: "Remove-Module"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "Remove-PSBreakpoint" (Indicator: "Remove-PSBreakpoint"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "Remove-Variable" (Indicator: "Remove-Variable"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "Remove-PSSnapin" (Indicator: "Remove-PSSnapin"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "Remove-TypeData" (Indicator: "Remove-TypeData"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "Remove-Event" (Indicator: "Remove-Event"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "Unregister-Event" (Indicator: "Unregister-Event"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "Remove-PSDrive" (Indicator: "Remove-PSDrive"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "Remove-ItemProperty" (Indicator: "Remove-ItemProperty"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "Remove-Computer" (Indicator: "Remove-Computer"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "Remove-WmiObject" (Indicator: "Remove-WmiObject"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp")54:T4de,Found string "DisableBehaviorMonitoring" (Indicator: "disablebehaviormonitoring"; Source: "00000000-00003208.00000001.143742.20B10000.00000004.mdmp, 00000000-00003208.00000002.145665.20B10000.00000004.mdmp") Found string "DisableBlockAtFirstSeen" (Indicator: "disableblockatfirstseen"; Source: "00000000-00003208.00000001.143742.20B10000.00000004.mdmp, 00000000-00003208.00000002.145665.20B10000.00000004.mdmp") Found string "DisableIntrusionPreventionSystem" (Indicator: "disableintrusionpreventionsystem"; Source: "00000000-00003208.00000001.143742.20B10000.00000004.mdmp, 00000000-00003208.00000002.145665.20B10000.00000004.mdmp") Found string "DisableIOAVProtection" (Indicator: "disableioavprotection"; Source: "00000000-00003208.00000001.143742.20B10000.00000004.mdmp, 00000000-00003208.00000002.145665.20B10000.00000004.mdmp") Found string "DisableRealtimeMonitoring" (Indicator: "disablerealtimemonitoring"; Source: "00000000-00003208.00000001.143742.20B10000.00000004.mdmp, 00000000-00003208.00000002.145665.20B10000.00000004.mdmp") Found string "DisableScriptScanning" (Indicator: "disablescriptscanning"; Source: "00000000-00003208.00000001.143742.20B10000.00000004.mdmp, 00000000-00003208.00000002.145665.20B10000.00000004.mdmp")55:T57f,Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; File: "9a2476c6474745cfacee35d15a3d4034d8d254304be3fa17a170ec0af9f9077e.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "9a2476c6474745cfacee35d15a3d4034d8d254304be3fa17a170ec0af9f9077e.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "9a2476c6474745cfacee35d15a3d4034d8d254304be3fa17a170ec0af9f9077e.bin") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "9a2476c6474745cfacee35d15a3d4034d8d254304be3fa17a170ec0af9f9077e.bin") Found reference to API "CopySid" (Indicator: "CopySid"; File: "9a2476c6474745cfacee35d15a3d4034d8d254304be3fa17a170ec0af9f9077e.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "9a2476c6474745cfacee35d15a3d4034d8d254304be3fa17a170ec0af9f9077e.bin") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "9a2476c6474745cfacee35d15a3d4034d8d254304be3fa17a170ec0af9f9077e.bin") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "9a2476c6474745cfacee35d15a3d4034d8d254304be3fa17a170ec0af9f9077e.bin") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; File: "9a2476c6474745cfacee35d15a3d4034d8d254304be3fa17a170ec0af9f9077e.bin")56:T438,Found string "Disable-PSBreakpoint" (Indicator: "Disable-PSBreakpoint"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "Stop-Transcript" (Indicator: "Stop-Transcript"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "Disable-PSRemoting" (Indicator: "Disable-PSRemoting"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "Disable-RunspaceDebug" (Indicator: "Disable-RunspaceDebug"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "Stop-Process" (Indicator: "Stop-Process"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "Suspend-Service" (Indicator: "Suspend-Service"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "Disable-ComputerRestore" (Indicator: "Disable-ComputerRestore"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp") Found string "Stop-Computer" (Indicator: "Stop-Computer"; Source: "00000000-00003208.00000000.141825.050D0000.00000004.mdmp")57:Ta8b,"