26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 73:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4d1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample b21f0707c702… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample b21f0707c702…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 2/27 AV engines flagged this file. 3 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","64bits","assembly","executable"],"identifier":"b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":2,"total":27},"behavioralIndicators":{"malicious":3,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4c9,Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=MSIL" (Source: "00000000-00007476.00000000.258914.E1300000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00007476.00000000.258914.E1300000.00000004.mdmp, 00000000-00007476.00000001.259141.E1300000.00000004.mdmp") Found string ":\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation.ni.dll" (Source: "00000000-00007476.00000000.258914.E1300000.00000004.mdmp, 00000000-00007476.00000001.259141.E1300000.00000004.mdmp") Found string ".Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00007476.00000000.258914.E1300000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00007476.00000000.258914.E1300000.00000004.mdmp, 00000000-00007476.00000001.259141.E1300000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00007476.00000000.258914.FB6E0000.00000004.mdmp")28:T532,Found string "Switch.System.IO.Compression.DoNotUseNativeZipLibraryForDecompression" (Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string "GZipStream" (Source: "00000000-00002092.00000002.262576.00282000.00000002.mdmp") Found string "system.io.compression" (Source: "00000000-00007476.00000001.259141.46AF0000.00000004.mdmp, 00000000-00007476.00000001.259141.46B00000.00000004.mdmp") Found string "compressionmode" (Source: "00000000-00007476.00000001.259141.46AF0000.00000004.mdmp") Found string "decompressionmethods" (Source: "00000000-00007476.00000001.259141.46AF0000.00000004.mdmp") Found string "compressionlevel" (Source: "00000000-00007476.00000001.259141.46AF0000.00000004.mdmp") Found string "compressionstrategy" (Source: "00000000-00007476.00000001.259141.46AF0000.00000004.mdmp") Found string "compressionmethod" (Source: "00000000-00007476.00000001.259141.46B00000.00000004.mdmp") Found string "compressiontracingswitchlevel" (Source: "00000000-00007476.00000001.259141.46B00000.00000004.mdmp") Found string "compressiontracingswitch" (Source: "00000000-00007476.00000001.259141.46B00000.00000004.mdmp")29:T1538,Found reference to API "VirtualAlloc:" (Indicator: "VirtualAlloc"; File: "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin") Found reference to API "CreateThread:" (Indicator: "CreateThread"; File: "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin") Found reference to API "FAIL: CreateThread" (Indicator: "CreateThread"; File: "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin") Found reference to API "VirtualAllocCreateThread-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "VirtualAlloc"; File: "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin") Found reference to API "VirtualAllocCreateThread-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "CreateThread"; File: "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin") Found reference to API "VirtualAlloc:" (Indicator: "VirtualAlloc"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found reference to API "CreateThread:" (Indicator: "CreateThread"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found reference to API "FAIL: CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00002092.00000001.260659.02A10000.00000004.mdmp, 00000000-00002092.00000002.262576.02A10000.00000004.mdmp, 00000000-00002092.00000003.268095.02A10000.00000004.mdmp") Found reference to API "VirtualAlloc: 0x1FC80000 err=0" (Indicator: "VirtualAlloc"; Source: "00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found reference to API "[13:03:32.591] VirtualAlloc: 0x1FC80000 err=0" (Indicator: "VirtualAlloc"; Source: "00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found reference to API "CreateThread: 0x3AC TID=6564 err=0" (Indicator: "CreateThread"; Source: "00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found reference to API "[13:03:32.638] CreateThread: 0x3AC TID=6564 err=0" (Indicator: "CreateThread"; Source: "00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp") Found reference to API "AIL: CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002092.00000002.262576.00282000.00000002.mdmp") Found reference to API "VirtualAllocCreateThread-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "VirtualAlloc"; Source: "00000000-00002092.00000002.262576.00282000.00000002.mdmp") Found reference to API "VirtualAllocCreateThread-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "CreateThread"; Source: "00000000-00002092.00000002.262576.00282000.00000002.mdmp")2a:T659,Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadByte" in "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "WriteByte" in "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt32" in "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt16" in "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt64" in "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "WriteInt64" in "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin"2b:T809,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.02A10000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.00282000.00000002.mdmp, 00000000-00002092.00000002.262576.02A10000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.02A10000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp")2c:T6d7,Found reference to API "LoadLibraryAVirtualProtect" (Indicator: "LoadLibrary"; File: "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp") Found reference to API "LoadLibraryAVirtualProtect" (Indicator: "LoadLibrary"; Source: "00000000-00002092.00000002.262576.00282000.00000002.mdmp")2d:T47f,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002092.00000001.260659.02A10000.00000004.mdmp, 00000000-00002092.00000001.260659.201AE000.00000004.mdmp, 00000000-00002092.00000002.262576.02A10000.00000004.mdmp, 00000000-00002092.00000002.262576.201AE000.00000004.mdmp, 00000000-00002092.00000003.268095.02A10000.00000004.mdmp, 00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp, 00000000-00002092.00000003.268095.201AE000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002092.00000001.260659.02A10000.00000004.mdmp, 00000000-00002092.00000001.260659.201AE000.00000004.mdmp, 00000000-00002092.00000002.262576.02A10000.00000004.mdmp, 00000000-00002092.00000002.262576.201AE000.00000004.mdmp, 00000000-00002092.00000003.268095.02A10000.00000004.mdmp, 00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp, 00000000-00002092.00000003.268095.201AE000.00000004.mdmp")2e:T2825,file/memory contains long string with (Indicator: "Aes"; File: "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin") file/memory contains long string with (Indicator: "RC2"; File: "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin") file/memory contains long string with (Indicator: "Oid"; File: "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10" (Indicator: "SHA384"; File: "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin") Found reference to "Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S" (Indicator: "SHA384"; File: "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin") Found reference to "Mhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0" (Indicator: "SHA384"; File: "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin") Found reference to "Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0" (Indicator: "SHA384"; File: "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" (Indicator: "SHA384"; File: "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00002092-00000BC0-3012663650") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp")2f:T708,Observed string: "AmsiScanBuffer" (Indicator: "amsiscanbuffer") in Source: b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin Observed string: "amsi.dllNtQueryInformationProcess" (Indicator: "amsi.dll") in Source: b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin Observed string: "amsi.dll" (Indicator: "amsi.dll") in Source: 00000000-00002092.00000000.258737.02A10000.00000004.mdmp 00000000-00002092.00000000.258737.05100000.00000004.mdmp 00000000-00002092.00000001.260659.05100000.00000004.mdmp 00000000-00002092.00000002.262576.05100000.00000004.mdmp 00000000-00002092.00000003.268095.05100000.00000004.mdmp Observed string: ":\WINDOWS\SYSTEM32\amsi.dll" (Indicator: "amsi.dll") in Source: 00000000-00002092.00000000.258737.02A10000.00000004.mdmp 00000000-00002092.00000001.260659.02A10000.00000004.mdmp 00000000-00002092.00000002.262576.02A10000.00000004.mdmp 00000000-00002092.00000003.268095.02A10000.00000004.mdmp Observed string: ":\amsi.dll" (Indicator: "amsi.dll") in Source: 00000000-00002092.00000000.258737.02A10000.00000004.mdmp Observed string: "AmsiScanBuffer" (Indicator: "amsiscanbuffer") in Source: 00000000-00002092.00000000.258737.05100000.00000004.mdmp 00000000-00002092.00000001.260659.05100000.00000004.mdmp 00000000-00002092.00000002.262576.00282000.00000002.mdmp 00000000-00002092.00000002.262576.05100000.00000004.mdmp 00000000-00002092.00000003.268095.05100000.00000004.mdmp Observed string: "amsi.dllNtQueryInformationProcess" (Indicator: "amsi.dll") in Source: 00000000-00002092.00000002.262576.00282000.00000002.mdmp Observed string: ":\WINDOWS\SYSTEM32\amsi.dll" (Indicator: "amsi.dll") in Source: 00000000-00007476.00000000.258914.FB6E0000.00000004.mdmp 00000000-00007476.00000001.259141.FB6E0000.00000004.mdmp30:T451,"powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG\DEFAULT") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CI\CONFIG") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CI\CONFIG") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CI\CONFIG\DEFAULT") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG\DEFAULT") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CI\CONFIG") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CI\CONFIG\DEFAULT")31:T616,"powershell.exe" queried SystemProcessInformation at 00000000-00007476-00000C15-3015706791 [PID: 7476] "powershell.exe" queried SystemProcessInformation at 00000000-00007476-00000C15-3015716073 [PID: 7476] "powershell.exe" queried SystemProcessInformation at 00000000-00007476-00000C15-3017104172 [PID: 7476] "powershell.exe" queried SystemProcessInformation at 00000000-00007476-00000C15-3017111452 [PID: 7476] "powershell.exe" queried SystemProcessInformation at 00000000-00007476-00000C15-3017952875 [PID: 7476] "powershell.exe" queried SystemProcessInformation at 00000000-00007476-00000C15-3017959972 [PID: 7476] "powershell.exe" queried SystemProcessInformation at 00000000-00007476-00000C15-3018356259 [PID: 7476] "powershell.exe" queried SystemProcessInformation at 00000000-00007476-00000C15-3018365340 [PID: 7476] "powershell.exe" queried SystemProcessInformation at 00000000-00007476-00000C15-3018522763 [PID: 7476] "powershell.exe" queried SystemProcessInformation at 00000000-00007476-00000C15-3018531449 [PID: 7476] "powershell.exe" queried SystemProcessInformation at 00000000-00007476-00000C15-3019630530 [PID: 7476] "powershell.exe" queried SystemProcessInformation at 00000000-00007476-00000C15-3020082110 [PID: 7476] "powershell.exe" queried SystemProcessInformation at 00000000-00007476-00000C15-3020090736 [PID: 7476] "powershell.exe" queried SystemProcessInformation at 00000000-00007476-00000C15-3020671716 [PID: 7476] "powershell.exe" queried SystemProcessInformation at 00000000-00007476-00000C15-3020679709 [PID: 7476]32:T63c,Found api reference "CryptStringToBinaryA" (Indicator: "CryptStringToBinaryA"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.02A10000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000002.262576.02A10000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.02A10000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp") Found api reference "CryptBinaryToStringA" (Indicator: "CryptBinaryToStringA"; Source: "00000000-00002092.00000001.260659.02A10000.00000004.mdmp, 00000000-00002092.00000002.262576.02A10000.00000004.mdmp, 00000000-00002092.00000003.268095.02A10000.00000004.mdmp") Found api reference "CryptUnprotectData" (Indicator: "CryptUnprotectData"; Source: "00000000-00002092.00000001.260659.02A10000.00000004.mdmp, 00000000-00002092.00000002.262576.02A10000.00000004.mdmp, 00000000-00002092.00000003.268095.02A10000.00000004.mdmp") Found api reference "CryptImportKey" (Indicator: "CryptImportKey"; Source: "00000000-00007476.00000000.258914.FB6E0000.00000004.mdmp, 00000000-00007476.00000001.259141.FD15C000.00000004.mdmp") Found api reference "CryptExportKey" (Indicator: "CryptExportKey"; Source: "00000000-00007476.00000000.258914.FB6E0000.00000004.mdmp") Found api reference "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00007476.00000000.258914.FB6E0000.00000004.mdmp")33:T19be,Contains base64 string in header "POST" in header "POST /9ed69920a0744799b479.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.173Content-Length: 132Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /9ed69920a0744799b479.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.173Content-Length: 132Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /9ed69920a0744799b479.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.173Content-Length: 132Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /9ed69920a0744799b479.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.173Content-Length: 132Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /9ed69920a0744799b479.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.173Content-Length: 132Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /9ed69920a0744799b479.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.173Content-Length: 6560Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /9ed69920a0744799b479.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.173Content-Length: 6560Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /9ed69920a0744799b479.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.173Content-Length: 6560Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /9ed69920a0744799b479.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.173Content-Length: 6560Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /9ed69920a0744799b479.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.173Content-Length: 6560Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /9ed69920a0744799b479.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.173Content-Length: 368Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /9ed69920a0744799b479.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.173Content-Length: 368Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /9ed69920a0744799b479.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.173Content-Length: 368Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /9ed69920a0744799b479.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.173Content-Length: 368Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /9ed69920a0744799b479.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.173Content-Length: 368Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /9ed69920a0744799b479.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.173Content-Length: 36720Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /9ed69920a0744799b479.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.173Content-Length: 36720Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /9ed69920a0744799b479.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.173Content-Length: 36720Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /9ed69920a0744799b479.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.173Content-Length: 36720Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /9ed69920a0744799b479.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.173Content-Length: 36720Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /9ed69920a0744799b479.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.173Content-Length: 73136Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /9ed69920a0744799b479.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.173Content-Length: 73136Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /9ed69920a0744799b479.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.173Content-Length: 73136Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /9ed69920a0744799b479.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.173Content-Length: 73136Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /9ed69920a0744799b479.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.173Content-Length: 73136Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /9ed69920a0744799b479.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.173Content-Length: 233328Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /9ed69920a0744799b479.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.173Content-Length: 233328Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /9ed69920a0744799b479.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.173Content-Length: 233328Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /9ed69920a0744799b479.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.173Content-Length: 233328Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "233328Connection" in header "POST /9ed69920a0744799b479.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.173Content-Length: 233328Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /9ed69920a0744799b479.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.173Content-Length: 233328Connection: Keep-AliveCache-Control: no-cache"34:T5af,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Contains ability to decode base64 data Matched sigs: Contains reference to cryptographic keys Matched sigs: Able to access crypto wallet extension (string) Matched sigs: Found Crypto currency wallets related strings Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Reads the cryptographic machine GUID Matched sigs: Able to decode string content at runtime (.NET) Matched sigs: Able to access crypto-related API (String) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Tries to steal crypto wallet extension (string) Matched sigs: Able to decrypt/decode data Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: HTTP requests contain Base64 strings35:T4c7,file/memory contains long string with (Indicator: "github.com"; File: "bcvyDrcDt8SN") Found string "r.youtube.com" (Indicator: "youtube.com"; Source: "00000000-00002092.00000002.262576.02A10000.00000004.mdmp") Found string "studio.youtube.com" (Indicator: "youtube.com"; Source: "00000000-00002092.00000002.262576.02A10000.00000004.mdmp") Found string "v.youtube.com" (Indicator: "youtube.com"; Source: "00000000-00002092.00000002.262576.02A10000.00000004.mdmp") Found string ".github.com_octo/" (Indicator: "github.com"; Source: "00000000-00002092.00000003.268095.20160000.00000004.mdmp, 00000000-00002092.00000003.268095.201AE000.00000004.mdmp") Found string ".github.comlogged_in/" (Indicator: "github.com"; Source: "00000000-00002092.00000003.268095.20160000.00000004.mdmp, 00000000-00002092.00000003.268095.201AE000.00000004.mdmp") Found string ".github.comlogged_inv10" (Indicator: "github.com"; Source: "00000000-00002092.00000003.268095.20160000.00000004.mdmp, 00000000-00002092.00000003.268095.201AE000.00000004.mdmp") Found string ".github.com_octov10"A" (Indicator: "github.com"; Source: "00000000-00002092.00000003.268095.20160000.00000004.mdmp 00000000-00002092.00000003.268095.201AE000.00000004.mdmp")36:T40b,Found string "GetUserNameW" (Source: "00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp") Found string "- UserName:" (Source: "00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp") Found string "- UserName: HAPUBWS" (Source: "00000000-00002092.00000001.260659.20160000.00000004.mdmp, 00000000-00002092.00000002.262576.20160000.00000004.mdmp, 00000000-00002092.00000003.268095.20160000.00000004.mdmp") Found string "UserName" (Source: "00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp") Found string "etUserNameW" (Source: "00000000-00007476.00000000.258914.FB6E0000.00000004.mdmp") Found string "etUserNameExA" (Source: "00000000-00007476.00000000.258914.FB6E0000.00000004.mdmp, 00000000-00007476.00000001.259141.FD15C000.00000004.mdmp") Found string "etUserNameExW" (Source: "00000000-00007476.00000000.258914.FB6E0000.00000004.mdmp, 00000000-00007476.00000001.259141.FD15C000.00000004.mdmp")37:T744,Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00002092.00000001.260659.02A10000.00000004.mdmp, 00000000-00002092.00000002.262576.02A10000.00000004.mdmp, 00000000-00002092.00000003.268095.02A10000.00000004.mdmp, 00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp")38:Teda,"powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007476) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007476) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0acdcfb46020000000000000000000051ed46d6f87f000000000000460200000000000000000000a67f078cbce700002a0000000000000050073fe1460200008fec46d6f87f0000e0acdcfb46020000e0acdcfb46020000000000000000000000000000f87f0000ffffff7f3742000000000000000000000000000000000000d8ced0fb460200002a0000000000000069c389fb460200003100000000000000f403000000000000f803000000000000110001100000000020d217a6c700000003a311d4f87f000020d217a6c700000000000000000000002b00000000000000000000000000000020b08ffb46020000b43f8efb46020000e0ced0fb (UID: 00000000-00007476) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000400000000000000000004ee1460200000b8e44d6f87f000000004ee14602000002000000460200003800000000000000400000000000000030034ee14602000068e008a7c7000000010000000000000003000000000000000100000000000000180000000000000020102fe146020000000000000000000000002fe14602000068b87afb4602000000000000000000005101000001000000000000000000000080000000000000000400000000000000000000000000000098ba7afb4602000004000000000000003800000000000000f09810d4f87f000038000000000000003800000000000000e0e108a7c7000000c00cc3b0f87f000000000000 (UID: 00000000-00007476) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b03acbf87f000007000000000000000000000000000000010000000000000070ed4ee146020000000000000000000050a306fd460200004c9810d4f87f000040c106fd46020000b3ceb9b0f87f0000a0a906fd46020000004f3acbf87f0000d0b03acbf87f000000000000000000000000000000000000a0a906fd4602000070ed4ee146020000b0cc06fd4602000038e208a7c70000004c9810d4f87f0000010000000000000038e208a7c7000000b0cc06fd46020000a0a906fd46020000010000000000000002bcb9b0f87f0000f0a706fd46020000a0ff04fd46020000feffffff040000007df039cbf87f0000b0ce06fd (UID: 00000000-00007476) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000007000000000000000000000000000000010000000000000070ed4ee146020000000000000000000050a306fd460200004c9810d4f87f0000c0bb06fd46020000b3ceb9b0f87f000020ab06fd46020000384f3acbf87f0000d0b03acbf87f00000000000000000000000000000000000020ab06fd4602000070ed4ee146020000b0cc06fd4602000030e208a7c70000004c9810d4f87f0000010000000000000030e208a7c7000000b0cc06fd4602000020ab06fd46020000010000000000000002bcb9b0f87f00000000000000000000a0ff04fd46020000f0a706fd04000000feffffffffffffff70ed4ee1460200007df039cbf87f000000000000 (UID: 00000000-00007476)39:T50b,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp") Found reference to API "GetSystemTimeAsF" (Indicator: "GetSystemTime"; Source: "00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp")3a:T50b,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp") Found reference to API "GetSystemTimeAsF" (Indicator: "GetSystemTime"; Source: "00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp")3b:Tcc5,"powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007476-00000C17-3019112636 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00007476-00000C17-3019292419 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00007476-00000C17-3019918798 "powershell.exe" queries volume information of "C:\" at 00000000-00007476-00000C17-3020427454 "powershell.exe" queries volume information of "C:\share" at 00000000-00007476-00000C17-3020428916 "powershell.exe" queries volume information of "C:\share" at 00000000-00007476-00000C17-3020511723 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007476-00000C17-3021304066 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007476-00000C17-3021338200 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007476-00000C17-3021774282 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007476-00000C17-3021902701 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007476-00000C17-3021938463 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007476-00000C17-3021999051 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007476-00000C17-3022062240 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007476-00000C17-3022098084 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007476-00000C17-30221323243c:Ta0c,"9iqmgvw,czcthawte," - Source: "00000000-00007476.00000000.258914.FB6E0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e2.5.29.1emenourcesrovidersystem.management.automation.resources2.5.4.3globalsign" - Source: "00000000-00007476.00000000.258914.FB6E0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007476.00000000.258914.FB6E0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007476.00000000.258914.FB6E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007476.00000000.258914.FB6E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007476.00000000.258914.FB6E0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007476.00000000.258914.FB6E0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007476.00000000.258914.FB6E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007476.00000000.258914.FB6E0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007476.00000000.258914.FB6E0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007476.00000000.258914.FB6E0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007476.00000000.258914.FB6E0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007476.00000000.258914.FB6E0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl02.5.29.101.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00007476.00000000.258914.FB6E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007476.00000000.258914.FB6E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00007476.00000000.258914.FB6E0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00007476.00000000.258914.FB6E0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00007476.00000000.258914.FB6E0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00007476.00000000.258914.FB6E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007476.00000000.258914.FB6E0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00007476.00000000.258914.FB6E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007476.00000000.258914.FB6E0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00007476.00000000.258914.FD040000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007476.00000000.258914.FD040000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007476.00000000.258914.FD040000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00007476.00000001.259141.CB3A2000.00000002.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00007476.00000001.259141.FB6E0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00007476.00000001.259141.FB6E0000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00007476.00000001.259141.FB6E0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00007476.00000001.259141.FB6FC000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e2.5.29.1callsite.targetrovidercallsite.target2.5.4.3globalsign" - Source: "00000000-00007476.00000001.259141.FB6FC000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007476.00000001.259141.FB6FC000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007476.00000001.259141.FB6FC000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007476.00000001.259141.FB6FC000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007476.00000001.259141.FB6FC000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007476.00000001.259141.FB6FC000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007476.00000001.259141.FB6FC000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007476.00000001.259141.FB6FC000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007476.00000001.259141.FB6FC000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007476.00000001.259141.FB6FC000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007476.00000001.259141.FB6FC000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007476.00000001.259141.FB6FC000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl02.5.29.101.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00007476.00000001.259141.FB6FC000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007476.00000001.259141.FB6FC000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00007476.00000001.259141.FB6FC000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00007476.00000001.259141.FB6FC000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00007476.00000001.259141.FB6FC000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00007476.00000001.259141.FB6FC000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007476.00000001.259141.FB6FC000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00007476.00000001.259141.FB6FC000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007476.00000001.259141.FB6FC000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhresg" - Source: "00000000-00007476.00000001.259141.FB6FC000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00007476.00000001.259141.FD040000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007476.00000001.259141.FD040000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007476.00000001.259141.FD040000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4bsjbv4.0.30319" - Source: "00000000-00007476.00000001.259141.FD15C000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.micross]callsite.target1htt]]lt.htm0@x]7" - Source: "00000000-00007476.00000001.259141.FD15C000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsmicrosoft.management.infrastructure.userfilteredexceptionhandlingrefemit_inmemorymanifestmodulemscorlibsystem.diagnosticsdebuggableattributedebuggingmodes.ctorsystem.runtime.compilerservicesruntimecompatibilityattributesystemobjectuserfilteredexceptionhandlingexceptionactioninvokefunc" - Source: "00000000-00007476.00000001.259141.FD15C000.00000004.mdmp")58:T560,Found registry query API: "RegQueryValueExA" in "00000000-00002092.00000001.260659.02A10000.00000004.mdmp, 00000000-00002092.00000002.262576.02A10000.00000004.mdmp, 00000000-00002092.00000003.268095.02A10000.00000004.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00002092.00000001.260659.02A10000.00000004.mdmp, 00000000-00002092.00000002.262576.02A10000.00000004.mdmp, 00000000-00002092.00000003.268095.02A10000.00000004.mdmp" Found registry query API: "RegEnumKeyExA" in "00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp" Found registry query API: "RegEnumValueA" in "00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp" Found registry query API: "RegGetValueA" in "00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp"59:T8de,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007476) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00007476) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007476) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00007476) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00007476) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00007476) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00007476) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00007476) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00007476) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00007476) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00007476) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00007476) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00007476) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00007476) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00007476) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00007476) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00007476) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00007476) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00007476) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\* (UID: 00000000-00007476)5a:T28e6,Found string "FromBase64String" (Indicator: "base64"; File: "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin") Found string "GZipStream" (Indicator: "GzipStream"; File: "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin") file/memory contains long string with (Indicator: "aes"; File: "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin") file/memory contains long string with (Indicator: "base64"; File: "dGU5uSNsX8Id") file/memory contains long string with (Indicator: "aes"; File: "PCAP") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00002092.00000000.258737.02A10000.00000004.mdmp, 00000000-00002092.00000001.260659.02A10000.00000004.mdmp, 00000000-00002092.00000002.262576.02A10000.00000004.mdmp, 00000000-00002092.00000003.268095.02A10000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00002092.00000000.258737.02A10000.00000004.mdmp, 00000000-00002092.00000001.260659.02A10000.00000004.mdmp, 00000000-00002092.00000002.262576.02A10000.00000004.mdmp, 00000000-00002092.00000003.268095.02A10000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ecdsa"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string "System.Security.Cryptography.MD5Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string "System.Security.Cryptography.SHA1Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string "System.Security.Cryptography.SHA256Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string "System.Security.Cryptography.DpapiDataProtector, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp")5b:T550,Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp")5c:T1576,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin") Found reference to API "PEB patch: NtQueryInformationProcess not resolved" (Indicator: "QueryInformationProcess"; File: "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin") Found reference to API "amsi.dllNtQueryInformationProcess" (Indicator: "QueryInformationProcess"; File: "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin") Found reference to API "PEB patch: NtQueryInformationProcess not resolved" (Indicator: "QueryInformationProcess"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.02A10000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000002.262576.02A10000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.02A10000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00002092.00000001.260659.02A10000.00000004.mdmp, 00000000-00002092.00000002.262576.02A10000.00000004.mdmp, 00000000-00002092.00000003.268095.02A10000.00000004.mdmp") Found reference to API "GetModuleHandleE" (Indicator: "GetModuleHandle"; Source: "00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp") Found reference to API "EB patch: NtQueryInformationProcess not resolved" (Indicator: "QueryInformationProcess"; Source: "00000000-00002092.00000002.262576.00282000.00000002.mdmp") Found reference to API "amsi.dllNtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00002092.00000002.262576.00282000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002092.00000002.262576.00282000.00000002.mdmp") Found reference to API "11372780644,7528,3121,,CreateToolhelp32Snapshot,kernel32.dll,"01:07:25.437",RX=0,PX=0" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00007476.00000000.258914.FB6E0000.00000004.mdmp")5d:T5fc,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp") Found reference to API "GetModuleHandleE" (Indicator: "GetModuleHandle"; Source: "00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002092.00000002.262576.00282000.00000002.mdmp")5e:T538,Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00002092.00000001.260659.02A10000.00000004.mdmp, 00000000-00002092.00000002.262576.02A10000.00000004.mdmp, 00000000-00002092.00000003.268095.02A10000.00000004.mdmp") Found reference to API "ReadDirectoryChangesW" (Indicator: "ReadDirectoryChange"; Source: "00000000-00002092.00000001.260659.02A10000.00000004.mdmp, 00000000-00002092.00000002.262576.02A10000.00000004.mdmp, 00000000-00002092.00000003.268095.02A10000.00000004.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp")5f:T437,Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp") Found reference to API "K32GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00002092.00000001.260659.02A10000.00000004.mdmp, 00000000-00002092.00000002.262576.02A10000.00000004.mdmp, 00000000-00002092.00000003.268095.02A10000.00000004.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp")60:T788,Found reference to API "PEB patch: NtQueryInformationProcess not resolved" (Indicator: "NtQueryInformationProcess"; File: "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin") Found reference to API "amsi.dllNtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; File: "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin") Found reference to API "PEB patch: NtQueryInformationProcess not resolved" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp") Found reference to API "EB patch: NtQueryInformationProcess not resolved" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00002092.00000002.262576.00282000.00000002.mdmp") Found reference to API "amsi.dllNtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00002092.00000002.262576.00282000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp")61:T94d,Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00002092.00000000.258737.02A10000.00000004.mdmp, 00000000-00002092.00000001.260659.02A10000.00000004.mdmp, 00000000-00002092.00000002.262576.02A10000.00000004.mdmp, 00000000-00002092.00000003.268095.02A10000.00000004.mdmp") Found string "os_password_blank" (Indicator: "password"; Source: "00000000-00002092.00000001.260659.02A10000.00000004.mdmp") Found string "os_password_last_changed" (Indicator: "password"; Source: "00000000-00002092.00000001.260659.02A10000.00000004.mdmp") Found string "password_manager" (Indicator: "password"; Source: "00000000-00002092.00000001.260659.02A10000.00000004.mdmp") Found string "passwords.txt" (Indicator: "password"; Source: "00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp") Found string "password:" (Indicator: "password"; Source: "00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp") Found string "(empty or master password protected)" (Indicator: "password"; Source: "00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp") Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00007476.00000001.259141.46AD0000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00007476.00000001.259141.46AF0000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00007476.00000001.259141.46AF0000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00007476.00000001.259141.46B00000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00007476.00000001.259141.46B00000.00000004.mdmp") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00007476.00000001.259141.46B70000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00007476.00000001.259141.46BB0000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00007476.00000001.259141.46BB0000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00007476.00000001.259141.46BB0000.00000004.mdmp")62:T42e,"\Thunderbird\Profiles" in Source: 00000000-00002092.00000001.260659.201AE000.00000004.mdmp 00000000-00002092.00000002.262576.201AE000.00000004.mdmp 00000000-00002092.00000003.268095.20160000.00000004.mdmp 00000000-00002092.00000003.268095.201AE000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\%s\%08d" in Source: 00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp "Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\%s\%08d" in Source: 00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp "Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\%s\%08d" in Source: 00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\%s\%08d" in Source: 00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\%s\%08d" in Source: 00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp "soft\Outlook\outlook.txt" in Source: 00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp63:T75e,"OFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\40078385-F676-4C61-9A9C-F9028599D6D3_is1" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00002092.00000001.260659.02A10000.00000004.mdmp "OFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7f8381ad-2e42-4432-8de5-c7beebe1009f}" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00002092.00000001.260659.02A10000.00000004.mdmp "OFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mitmproxy 8.1.1" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00002092.00000001.260659.02A10000.00000004.mdmp "OFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00002092.00000001.260659.02A10000.00000004.mdmp "OFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00002092.00000001.260659.02A10000.00000004.mdmp "OFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00002092.00000001.260659.02A10000.00000004.mdmp "OFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00002092.00000001.260659.02A10000.00000004.mdmp "OFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00002092.00000001.260659.02A10000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00002092.00000001.260659.02A10000.00000004.mdmp 00000000-00002092.00000002.262576.02A10000.00000004.mdmp 00000000-00002092.00000003.268095.02A10000.00000004.mdmp64:T468,Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00002092.00000000.258737.02A10000.00000004.mdmp, 00000000-00002092.00000001.260659.02A10000.00000004.mdmp, 00000000-00002092.00000002.262576.02A10000.00000004.mdmp, 00000000-00002092.00000003.268095.02A10000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002092.00000000.258737.02A10000.00000004.mdmp, 00000000-00002092.00000001.260659.02A10000.00000004.mdmp, 00000000-00002092.00000002.262576.02A10000.00000004.mdmp, 00000000-00002092.00000003.268095.02A10000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00007476.00000000.258914.E1300000.00000004.mdmp, 00000000-00007476.00000001.259141.E1300000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007476.00000000.258914.E1300000.00000004.mdmp, 00000000-00007476.00000001.259141.E1300000.00000004.mdmp")65:T34cc,Found string "VirtualAllocCreateThread-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disablerealtimemonitoring"; File: "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin") Found string "VirtualAllocCreateThread-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disablebehaviormonitoring"; File: "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin") Found string "VirtualAllocCreateThread-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disableblockatfirstseen"; File: "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin") Found string "VirtualAllocCreateThread-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disableioavprotection"; File: "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin") Found string "Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disablerealtimemonitoring"; File: "AMSI") Found string "Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disablebehaviormonitoring"; File: "AMSI") Found string "Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disableblockatfirstseen"; File: "AMSI") Found string "Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disableioavprotection"; File: "AMSI") Found string "-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disablerealtimemonitoring"; File: "powershell.exe") Found string "-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disablebehaviormonitoring"; File: "powershell.exe") Found string "-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disableblockatfirstseen"; File: "powershell.exe") Found string "-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disableioavprotection"; File: "powershell.exe") Found string "Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disablerealtimemonitoring"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string "Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disablebehaviormonitoring"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string "Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disableblockatfirstseen"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string "Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disableioavprotection"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string "-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disablerealtimemonitoring"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string "-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disablebehaviormonitoring"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string "-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disableblockatfirstseen"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string "-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disableioavprotection"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string "Interactive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disablerealtimemonitoring"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string "Interactive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disablebehaviormonitoring"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string "Interactive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disableblockatfirstseen"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string "Interactive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disableioavprotection"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string ""powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disablerealtimemonitoring"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string ""powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disablebehaviormonitoring"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string ""powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disableblockatfirstseen"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string ""powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disableioavprotection"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string "VirtualAllocCreateThread-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disablerealtimemonitoring"; Source: "00000000-00002092.00000002.262576.00282000.00000002.mdmp") Found string "VirtualAllocCreateThread-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disablebehaviormonitoring"; Source: "00000000-00002092.00000002.262576.00282000.00000002.mdmp") Found string "VirtualAllocCreateThread-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disableblockatfirstseen"; Source: "00000000-00002092.00000002.262576.00282000.00000002.mdmp") Found string "VirtualAllocCreateThread-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disableioavprotection"; Source: "00000000-00002092.00000002.262576.00282000.00000002.mdmp") Found string ""powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disablerealtimemonitoring"; Source: "00000000-00007476.00000000.258914.E1300000.00000004.mdmp, 00000000-00007476.00000001.259141.E1300000.00000004.mdmp") Found string ""powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disablebehaviormonitoring"; Source: "00000000-00007476.00000000.258914.E1300000.00000004.mdmp, 00000000-00007476.00000001.259141.E1300000.00000004.mdmp") Found string ""powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disableblockatfirstseen"; Source: "00000000-00007476.00000000.258914.E1300000.00000004.mdmp, 00000000-00007476.00000001.259141.E1300000.00000004.mdmp") Found string ""powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "disableioavprotection"; Source: "00000000-00007476.00000000.258914.E1300000.00000004.mdmp, 00000000-00007476.00000001.259141.E1300000.00000004.mdmp")66:Tf5e,Found string "VirtualAllocCreateThread-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "Set-MpPreference"; File: "b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin") Found string "Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "Set-MpPreference"; File: "AMSI") file/memory contains long string with (Indicator: "Set-MpPreference"; File: "AMSI") Found string "-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "Set-MpPreference"; File: "powershell.exe") Found string "Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "Set-MpPreference"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string "-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "Set-MpPreference"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string "Interactive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "Set-MpPreference"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string ""powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "Set-MpPreference"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp") Found string "VirtualAllocCreateThread-NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "Set-MpPreference"; Source: "00000000-00002092.00000002.262576.00282000.00000002.mdmp") Found string ""powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIOAVProtection 1 -DisableBehaviorMonitoring 1 -DisableBlockAtFirstSeen 1" (Indicator: "Set-MpPreference"; Source: "00000000-00007476.00000000.258914.E1300000.00000004.mdmp, 00000000-00007476.00000001.259141.E1300000.00000004.mdmp") Found string "Set-MpPreference" (Indicator: "Set-MpPreference"; Source: "00000000-00007476.00000000.258914.E1300000.00000004.mdmp, 00000000-00007476.00000000.258914.E14E0000.00000004.mdmp, 00000000-00007476.00000000.258914.FB6E0000.00000004.mdmp, 00000000-00007476.00000001.259141.E1300000.00000004.mdmp, 00000000-00007476.00000001.259141.E14E0000.00000004.mdmp, 00000000-00007476.00000001.259141.FB6FC000.00000004.mdmp, 00000000-00007476.00000001.259141.FD15C000.00000004.mdmp, 00000000-00007476.00000001.259141.FD1E9000.00000004.mdmp")67:T574,Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.02A10000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000002.262576.02A10000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.02A10000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp")68:T68d,"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"69be969c434d086b36055d9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69be969c434d086b36055d9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$59","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"69be969c434d086b36055d9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"69be969c434d086b36055d9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00007476)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"69be969c434d086b36055d9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"69be969c434d086b36055d9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00007476)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"69be969c434d086b36055d9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"69be969c434d086b36055d9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"69be969c434d086b36055d9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"69be969c434d086b36055d9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"69be969c434d086b36055d9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"69be969c434d086b36055d9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddressOrd\" (Indicator: \"GetProcAddress\"; File: \"b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002092.00000000.258737.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.05100000.00000004.mdmp, 00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000002.262576.00282000.00000002.mdmp, 00000000-00002092.00000002.262576.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.05100000.00000004.mdmp, 00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp\")\n Found reference to API \"GetProcAddressOrd\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002092.00000002.262576.00282000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"69be969c434d086b36055d9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"69be969c434d086b36055d9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00002092.00000001.260659.02A10000.00000004.mdmp, 00000000-00002092.00000002.262576.02A10000.00000004.mdmp, 00000000-00002092.00000003.268095.02A10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"69be969c434d086b36055d9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"69be969c434d086b36055d9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00002092.00000001.260659.02A10000.00000004.mdmp, 00000000-00002092.00000002.262576.02A10000.00000004.mdmp, 00000000-00002092.00000003.268095.02A10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"69be969c434d086b36055d9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00002092.00000001.260659.02A10000.00000004.mdmp, 00000000-00002092.00000002.262576.02A10000.00000004.mdmp, 00000000-00002092.00000003.268095.02A10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"69be969c434d086b36055d9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges","description":"System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at 2a27d4451c7cc45ded70062251e53952-600000a-UtilRuntimeValidator~RunCacheFactory","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-136","sources":[{"report_type":"sandbox","report_id":"69be969c434d086b36055d9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; File: \"b21f0707c70208612e756f2200ec9ee80ad0e8641cfdf3bdb34e7faf4d97172d.bin\")\n Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"00000000-00002092.00000002.262576.00282000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-217","sources":[{"report_type":"sandbox","report_id":"69be969c434d086b36055d9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$60","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"69be969c434d086b36055d9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$61","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"69be969c434d086b36055d9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found mail information locations related strings","description":"$62","origin":"File/Memory","mitre_attack_id":"T1114","relevance":1,"id":"string-129","sources":[{"report_type":"sandbox","report_id":"69be969c434d086b36055d9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"$63","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"69be969c434d086b36055d9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"hostname\" (Indicator: \"hostname\"; Source: \"00000000-00002092.00000001.260659.1FD0F000.00000004.mdmp, 00000000-00002092.00000003.268095.1FD0F000.00000004.mdmp\")\n Found string \"HostName\" (Indicator: \"hostname\"; Source: \"00000000-00002092.00000003.268095.1FCF4000.00000002.mdmp\")\n Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00007476.00000001.259141.46AF0000.00000004.mdmp, 00000000-00007476.00000001.259141.FD1E9000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69be969c434d086b36055d9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"