21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 84:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4b9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan_Win32_Wacatac_B_ml Sample bc1363062c4f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample bc1363062c4f…. Malware family: Trojan_Win32_Wacatac_B_ml. Threat score 100/100. 3/26 AV engines flagged this file. 7 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/bc1363062c4f4aff514d71fd85fc9a5a08ad7fc2ea9a40298bb8865d041b8a3f","keywords":["Malicious","Trojan_Win32_Wacatac_B_ml","malware analysis","sandbox report","threat intelligence","bc1363062c4f4aff514d71fd85fc9a5a08ad7fc2ea9a40298bb8865d041b8a3f"],"about":{"@type":"SoftwareApplication","name":"atrmenu.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"bc1363062c4f4aff514d71fd85fc9a5a08ad7fc2ea9a40298bb8865d041b8a3f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan_Win32_Wacatac_B_ml","antivirusDetections":{"malicious":3,"total":26},"behavioralIndicators":{"malicious":7,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T6b5,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00002864.00000000.206705.CF050000.00000004.mdmp, 00000000-00002864.00000001.206838.CF07C000.00000004.mdmp") Found string ":\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation.ni.dll" (Source: "00000000-00002864.00000000.206705.CF050000.00000004.mdmp, 00000000-00002864.00000001.206838.CF07C000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00002864.00000000.206705.CF050000.00000004.mdmp, 00000000-00002864.00000001.206838.CF07C000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=MSIL" (Source: "00000000-00002864.00000000.206705.E93D0000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" (Source: "00000000-00002864.00000001.206838.E93FC000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" (Source: "00000000-00002864.00000001.206838.E9482000.00000004.mdmp") Found string "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" (Source: "00000000-00002864.00000001.206838.E9A20000.00000004.mdmp") Found string "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" (Source: "00000000-00002864.00000001.206838.E9A20000.00000004.mdmp")23:T151a,Found string "system.io.compression" (Source: "00000000-00002864.00000000.206705.9CD30000.00000004.mdmp, 00000000-00002864.00000000.206705.9CD50000.00000004.mdmp") Found string "compressionmode" (Source: "00000000-00002864.00000000.206705.9CD30000.00000004.mdmp") Found string "decompressionmethods" (Source: "00000000-00002864.00000000.206705.9CD30000.00000004.mdmp") Found string "compressionlevel" (Source: "00000000-00002864.00000000.206705.9CD30000.00000004.mdmp") Found string "compressionstrategy" (Source: "00000000-00002864.00000000.206705.9CD30000.00000004.mdmp") Found string "compressionmethod" (Source: "00000000-00002864.00000000.206705.9CD30000.00000004.mdmp") Found string "compressiontracingswitchlevel" (Source: "00000000-00002864.00000000.206705.9CD50000.00000004.mdmp") Found string "compressiontracingswitch" (Source: "00000000-00002864.00000000.206705.9CD50000.00000004.mdmp") Found string "flush() method to finish the compression process." (Source: "00000000-00005244.00000000.205639.10C67000.00000002.mdmp, 00000000-00005244.00000002.209294.10F6E000.00000002.mdmp") Found string "preset compression level (with the 'preset' argument), or in detail" (Source: "00000000-00005244.00000000.205639.10C67000.00000002.mdmp, 00000000-00005244.00000000.205639.98310000.00000004.mdmp, 00000000-00005244.00000000.205639.989F0000.00000004.mdmp, 00000000-00005244.00000001.207558.98310000.00000004.mdmp, 00000000-00005244.00000001.207558.989F0000.00000004.mdmp") Found string "the raw compressor does not support preset compression levels." (Source: "00000000-00005244.00000000.205639.10C67000.00000002.mdmp, 00000000-00005244.00000000.205639.98310000.00000004.mdmp, 00000000-00005244.00000000.205639.989F0000.00000004.mdmp, 00000000-00005244.00000001.207558.98310000.00000004.mdmp, 00000000-00005244.00000001.207558.989F0000.00000004.mdmp") Found string "For one-shot compression, use the compress() function instead." (Source: "00000000-00005244.00000000.205639.10C67000.00000002.mdmp, 00000000-00005244.00000000.205639.98310000.00000004.mdmp, 00000000-00005244.00000000.205639.988F0000.00000004.mdmp, 00000000-00005244.00000000.205639.989F0000.00000004.mdmp, 00000000-00005244.00000001.207558.98310000.00000004.mdmp, 00000000-00005244.00000001.207558.988F0000.00000004.mdmp, 00000000-00005244.00000001.207558.989F0000.00000004.mdmp, 00000000-00005244.00000002.209294.10F6E000.00000002.mdmp, 00000000-00005244.00000002.209294.988F0000.00000004.mdmp") Found string "Finish the compression process." (Source: "00000000-00005244.00000000.205639.10C67000.00000002.mdmp, 00000000-00005244.00000001.207558.0ADBA000.00000002.mdmp, 00000000-00005244.00000002.209294.10F6E000.00000002.mdmp") Found string "decompression to fail if the input cannot be decompressed within the" (Source: "00000000-00005244.00000000.205639.10C67000.00000002.mdmp, 00000000-00005244.00000000.205639.98310000.00000004.mdmp, 00000000-00005244.00000000.205639.989F0000.00000004.mdmp, 00000000-00005244.00000001.207558.98310000.00000004.mdmp, 00000000-00005244.00000001.207558.989F0000.00000004.mdmp, 00000000-00005244.00000002.209294.98378000.00000004.mdmp") Found string "For one-shot decompression, use the decompress() function instead." (Source: "00000000-00005244.00000000.205639.10C67000.00000002.mdmp, 00000000-00005244.00000000.205639.98310000.00000004.mdmp, 00000000-00005244.00000000.205639.988F0000.00000004.mdmp, 00000000-00005244.00000000.205639.989F0000.00000004.mdmp, 00000000-00005244.00000000.205639.98BF0000.00000004.mdmp, 00000000-00005244.00000001.207558.98310000.00000004.mdmp, 00000000-00005244.00000001.207558.988F0000.00000004.mdmp, 00000000-00005244.00000001.207558.989F0000.00000004.mdmp, 00000000-00005244.00000001.207558.98BF0000.00000004.mdmp, 00000000-00005244.00000002.209294.10F6E000.00000002.mdmp, 00000000-00005244.00000002.209294.98378000.00000004.mdmp, 00000000-00005244.00000002.209294.988F0000.00000004.mdmp, 00000000-00005244.00000002.209294.98BF0000.00000004.mdmp") Found string "Invalid compression preset: %u" (Source: "00000000-00005244.00000000.205639.10C67000.00000002.mdmp") Found string "Failed to extract %s: decompression resulted in return code %d!" (Source: "00000000-00005244.00000000.205639.54ECE000.00000002.mdmp") Found string "unknown compression method" (Source: "00000000-00005244.00000000.205639.54ECE000.00000002.mdmp, 00000000-00005244.00000002.209294.F6E46000.00000002.mdmp") Found string "compression" (Source: "00000000-00005244.00000000.205639.98210000.00000004.mdmp, 00000000-00005244.00000000.205639.98410000.00000004.mdmp, 00000000-00005244.00000000.205639.988F0000.00000004.mdmp, 00000000-00005244.00000000.205639.98BF0000.00000004.mdmp, 00000000-00005244.00000001.207558.0ADBA000.00000002.mdmp, 00000000-00005244.00000001.207558.98210000.00000004.mdmp, 00000000-00005244.00000001.207558.98410000.00000004.mdmp, 00000000-00005244.00000001.207558.988F0000.00000004.mdmp, 00000000-00005244.00000001.207558.98BF0000.00000004.mdmp, 00000000-00005244.00000002.209294.0A281000.00000002.mdmp, 00000000-00005244.00000002.209294.0A5D2000.00000002.mdmp, 00000000-00005244.00000002.209294.0E25E000.00000002.mdmp, 00000000-00005244.00000002.209294.98210000.00000004.mdmp, 00000000-00005244.00000002.209294.98410000.00000004.mdmp, 00000000-00005244.00000002.209294.988F0000.00000004.mdmp, 00000000-00005244.00000002.209294.98BF0000.00000004.mdmp")24:T436,Found reference to API "Tcl_CreateThread" (Indicator: "CreateThread"; File: "bc1363062c4f4aff514d71fd85fc9a5a08ad7fc2ea9a40298bb8865d041b8a3f.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005244.00000000.205639.0A2DC000.00000002.mdmp, 00000000-00005244.00000002.209294.04692000.00000002.mdmp, 00000000-00005244.00000002.209294.06501000.00000002.mdmp, 00000000-00005244.00000002.209294.11034000.00000002.mdmp, 00000000-00005244.00000002.209294.185B6000.00000002.mdmp, 00000000-00005244.00000002.209294.730A3000.00000004.mdmp, 00000000-00005244.00000002.209294.FCC1A000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005244.00000000.205639.0A2DC000.00000002.mdmp, 00000000-00005244.00000001.207558.0AB6C000.00000002.mdmp, 00000000-00005244.00000002.209294.17A14000.00000002.mdmp, 00000000-00005244.00000002.209294.FCC1A000.00000004.mdmp") Found reference to API "Tcl_CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005244.00000000.205639.54ECE000.00000002.mdmp")25:Tbea,"d__198" (Indicator: "base64"; Source: "00000000-00002864.00000000.206705.9CE10000.00000004.mdmp, 00000000-00002864.00000001.206838.9CE10000.00000004.mdmp") Found string "d__148" (Indicator: "base64"; Source: "00000000-00002864.00000000.206705.9CE10000.00000004.mdmp, 00000000-00002864.00000001.206838.9CE10000.00000004.mdmp") Found string "d__151" (Indicator: "base64"; Source: "00000000-00002864.00000000.206705.9CE10000.00000004.mdmp, 00000000-00002864.00000001.206838.9CE10000.00000004.mdmp") Found string "d__484" (Indicator: "base64"; Source: "00000000-00002864.00000000.206705.9CE10000.00000004.mdmp, 00000000-00002864.00000001.206838.9CE10000.00000004.mdmp") Found string "d__110" (Indicator: "base64"; Source: "00000000-00002864.00000000.206705.9CE10000.00000004.mdmp, 00000000-00002864.00000001.206838.9CE10000.00000004.mdmp") Found string "d__37" (Indicator: "base64"; Source: "00000000-00002864.00000000.206705.9CE10000.00000004.mdmp, 00000000-00002864.00000001.206838.9CE10000.00000004.mdmp") Found string "d__487" (Indicator: "base64"; Source: "00000000-00002864.00000000.206705.9CE10000.00000004.mdmp, 00000000-00002864.00000001.206838.9CE10000.00000004.mdmp")69:T5c4,Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "bc1363062c4f4aff514d71fd85fc9a5a08ad7fc2ea9a40298bb8865d041b8a3f.bin") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "bc1363062c4f4aff514d71fd85fc9a5a08ad7fc2ea9a40298bb8865d041b8a3f.bin") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "bc1363062c4f4aff514d71fd85fc9a5a08ad7fc2ea9a40298bb8865d041b8a3f.bin") Found reference to API "FindFirstFile" (Indicator: "FindFirstFile"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp") Found reference to API "FindNextFile" (Indicator: "FindNextFile"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp, 00000000-00005244.00000000.205639.54ECE000.00000002.mdmp, 00000000-00005244.00000002.209294.04692000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp, 00000000-00005244.00000000.205639.54ECE000.00000002.mdmp, 00000000-00005244.00000002.209294.04692000.00000002.mdmp, 00000000-00005244.00000002.209294.06435000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00005244.00000000.205639.54ECE000.00000002.mdmp, 00000000-00005244.00000002.209294.06435000.00000002.mdmp")6a:T29eb,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "bc1363062c4f4aff514d71fd85fc9a5a08ad7fc2ea9a40298bb8865d041b8a3f.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "bc1363062c4f4aff514d71fd85fc9a5a08ad7fc2ea9a40298bb8865d041b8a3f.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "bc1363062c4f4aff514d71fd85fc9a5a08ad7fc2ea9a40298bb8865d041b8a3f.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "bc1363062c4f4aff514d71fd85fc9a5a08ad7fc2ea9a40298bb8865d041b8a3f.bin") Found reference to API "K32EnumProcessModules" (Indicator: "EnumProcessModules"; File: "bc1363062c4f4aff514d71fd85fc9a5a08ad7fc2ea9a40298bb8865d041b8a3f.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "bc1363062c4f4aff514d71fd85fc9a5a08ad7fc2ea9a40298bb8865d041b8a3f.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "bc1363062c4f4aff514d71fd85fc9a5a08ad7fc2ea9a40298bb8865d041b8a3f.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005244.00000000.205639.0A2DC000.00000002.mdmp, 00000000-00005244.00000000.205639.0ABA7000.00000002.mdmp, 00000000-00005244.00000000.205639.0AD33000.00000002.mdmp, 00000000-00005244.00000000.205639.0B94C000.00000002.mdmp, 00000000-00005244.00000000.205639.10C67000.00000002.mdmp, 00000000-00005244.00000000.205639.54ECE000.00000002.mdmp, 00000000-00005244.00000000.205639.98410000.00000004.mdmp, 00000000-00005244.00000001.207558.06962000.00000002.mdmp, 00000000-00005244.00000001.207558.0A58B000.00000002.mdmp, 00000000-00005244.00000001.207558.0AB6C000.00000002.mdmp, 00000000-00005244.00000001.207558.0ADBA000.00000002.mdmp, 00000000-00005244.00000001.207558.0BA1B000.00000002.mdmp, 00000000-00005244.00000001.207558.0BA80000.00000002.mdmp, 00000000-00005244.00000001.207558.0BC6F000.00000002.mdmp, 00000000-00005244.00000001.207558.0E239000.00000002.mdmp, 00000000-00005244.00000001.207558.13A48000.00000002.mdmp, 00000000-00005244.00000001.207558.16AC6000.00000002.mdmp, 00000000-00005244.00000001.207558.16E83000.00000002.mdmp, 00000000-00005244.00000001.207558.17815000.00000002.mdmp, 00000000-00005244.00000001.207558.17AE3000.00000002.mdmp, 00000000-00005244.00000001.207558.98410000.00000004.mdmp, 00000000-00005244.00000002.209294.03E06000.00000002.mdmp, 00000000-00005244.00000002.209294.040D8000.00000002.mdmp, 00000000-00005244.00000002.209294.04692000.00000002.mdmp, 00000000-00005244.00000002.209294.06305000.00000002.mdmp, 00000000-00005244.00000002.209294.063D7000.00000002.mdmp, 00000000-00005244.00000002.209294.06435000.00000002.mdmp, 00000000-00005244.00000002.209294.06473000.00000002.mdmp, 00000000-00005244.00000002.209294.06483000.00000002.mdmp, 00000000-00005244.00000002.209294.06492000.00000002.mdmp, 00000000-00005244.00000002.209294.06501000.00000002.mdmp, 00000000-00005244.00000002.209294.0679D000.00000002.mdmp, 00000000-00005244.00000002.209294.067F6000.00000002.mdmp, 00000000-00005244.00000002.209294.08A03000.00000002.mdmp, 00000000-00005244.00000002.209294.0A255000.00000002.mdmp, 00000000-00005244.00000002.209294.0A264000.00000002.mdmp, 00000000-00005244.00000002.209294.0A281000.00000002.mdmp, 00000000-00005244.00000002.209294.0A2A2000.00000002.mdmp, 00000000-00005244.00000002.209294.0A552000.00000002.mdmp, 00000000-00005244.00000002.209294.0A565000.00000002.mdmp, 00000000-00005244.00000002.209294.0A5D2000.00000002.mdmp, 00000000-00005244.00000002.209294.0AADF000.00000002.mdmp, 00000000-00005244.00000002.209294.0AD01000.00000002.mdmp, 00000000-00005244.00000002.209294.0E25E000.00000002.mdmp, 00000000-00005244.00000002.209294.10B77000.00000002.mdmp, 00000000-00005244.00000002.209294.10C39000.00000002.mdmp, 00000000-00005244.00000002.209294.10F53000.00000002.mdmp, 00000000-00005244.00000002.209294.10F6E000.00000002.mdmp, 00000000-00005244.00000002.209294.11034000.00000002.mdmp, 00000000-00005244.00000002.209294.11064000.00000002.mdmp, 00000000-00005244.00000002.209294.119D6000.00000002.mdmp, 00000000-00005244.00000002.209294.11B82000.00000002.mdmp, 00000000-00005244.00000002.209294.144B3000.00000002.mdmp, 00000000-00005244.00000002.209294.14D96000.00000002.mdmp, 00000000-00005244.00000002.209294.16A38000.00000002.mdmp, 00000000-00005244.00000002.209294.16DC2000.00000002.mdmp, 00000000-00005244.00000002.209294.17A14000.00000002.mdmp, 00000000-00005244.00000002.209294.185B6000.00000002.mdmp, 00000000-00005244.00000002.209294.730A3000.00000004.mdmp, 00000000-00005244.00000002.209294.98410000.00000004.mdmp, 00000000-00005244.00000002.209294.F6235000.00000002.mdmp, 00000000-00005244.00000002.209294.F6E46000.00000002.mdmp, 00000000-00005244.00000002.209294.FCC1A000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005244.00000000.205639.0A2DC000.00000002.mdmp, 00000000-00005244.00000000.205639.0ABA7000.00000002.mdmp, 00000000-00005244.00000000.205639.0AD33000.00000002.mdmp, 00000000-00005244.00000000.205639.0B94C000.00000002.mdmp, 00000000-00005244.00000000.205639.10C67000.00000002.mdmp, 00000000-00005244.00000000.205639.54ECE000.00000002.mdmp, 00000000-00005244.00000000.205639.999D0000.00000004.mdmp, 00000000-00005244.00000001.207558.06962000.00000002.mdmp, 00000000-00005244.00000001.207558.0A58B000.00000002.mdmp, 00000000-00005244.00000001.207558.0AB6C000.00000002.mdmp, 00000000-00005244.00000001.207558.0ADBA000.00000002.mdmp, 00000000-00005244.00000001.207558.0BA1B000.00000002.mdmp, 00000000-00005244.00000001.207558.0BA80000.00000002.mdmp, 00000000-00005244.00000001.207558.0BC6F000.00000002.mdmp, 00000000-00005244.00000001.207558.0E239000.00000002.mdmp, 00000000-00005244.00000001.207558.13A48000.00000002.mdmp, 00000000-00005244.00000001.207558.16AC6000.00000002.mdmp, 00000000-00005244.00000001.207558.16E83000.00000002.mdmp, 00000000-00005244.00000001.207558.17815000.00000002.mdmp, 00000000-00005244.00000001.207558.17AE3000.00000002.mdmp, 00000000-00005244.00000001.207558.999D0000.00000004.mdmp, 00000000-00005244.00000002.209294.03E06000.00000002.mdmp, 00000000-00005244.00000002.209294.040D8000.00000002.mdmp, 00000000-00005244.00000002.209294.04692000.00000002.mdmp, 00000000-00005244.00000002.209294.06305000.00000002.mdmp, 00000000-00005244.00000002.209294.063D7000.00000002.mdmp, 00000000-00005244.00000002.209294.06435000.00000002.mdmp, 00000000-00005244.00000002.209294.06473000.00000002.mdmp, 00000000-00005244.00000002.209294.06483000.00000002.mdmp, 00000000-00005244.00000002.209294.06492000.00000002.mdmp, 00000000-00005244.00000002.209294.06501000.00000002.mdmp, 00000000-00005244.00000002.209294.0679D000.00000002.mdmp, 00000000-00005244.00000002.209294.067F6000.00000002.mdmp, 00000000-00005244.00000002.209294.08A03000.00000002.mdmp, 00000000-00005244.00000002.209294.0A255000.00000002.mdmp, 00000000-00005244.00000002.209294.0A264000.00000002.mdmp, 00000000-00005244.00000002.209294.0A281000.00000002.mdmp, 00000000-00005244.00000002.209294.0A2A2000.00000002.mdmp, 00000000-00005244.00000002.209294.0A552000.00000002.mdmp, 00000000-00005244.00000002.209294.0A565000.00000002.mdmp, 00000000-00005244.00000002.209294.0A5D2000.00000002.mdmp, 00000000-00005244.00000002.209294.0AADF000.00000002.mdmp, 00000000-00005244.00000002.209294.0AD01000.00000002.mdmp, 00000000-00005244.00000002.209294.0E25E000.00000002.mdmp, 00000000-00005244.00000002.209294.10B77000.00000002.mdmp, 00000000-00005244.00000002.209294.10C39000.00000002.mdmp, 00000000-00005244.00000002.209294.10F53000.00000002.mdmp, 00000000-00005244.00000002.209294.10F6E000.00000002.mdmp, 00000000-00005244.00000002.209294.11034000.00000002.mdmp, 00000000-00005244.00000002.209294.11064000.00000002.mdmp, 00000000-00005244.00000002.209294.119D6000.00000002.mdmp, 00000000-00005244.00000002.209294.11B82000.00000002.mdmp, 00000000-00005244.00000002.209294.144B3000.00000002.mdmp, 00000000-00005244.00000002.209294.14D96000.00000002.mdmp, 00000000-00005244.00000002.209294.16A38000.00000002.mdmp, 00000000-00005244.00000002.209294.16DC2000.00000002.mdmp, 00000000-00005244.00000002.209294.17A14000.00000002.mdmp, 00000000-00005244.00000002.209294.185B6000.00000002.mdmp, 00000000-00005244.00000002.209294.730A3000.00000004.mdmp, 00000000-00005244.00000002.209294.999D0000.00000004.mdmp, 00000000-00005244.00000002.209294.F6235000.00000002.mdmp, 00000000-00005244.00000002.209294.F6E46000.00000002.mdmp, 00000000-00005244.00000002.209294.FCC1A000.00000004.mdmp") Found reference to API ":GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp") Found reference to API ":GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp") Found reference to API "|O:GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp, 00000000-00005244.00000000.205639.999D0000.00000004.mdmp, 00000000-00005244.00000001.207558.999D0000.00000004.mdmp, 00000000-00005244.00000002.209294.999D0000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp, 00000000-00005244.00000000.205639.54ECE000.00000002.mdmp, 00000000-00005244.00000001.207558.06962000.00000002.mdmp, 00000000-00005244.00000002.209294.04692000.00000002.mdmp, 00000000-00005244.00000002.209294.06435000.00000002.mdmp, 00000000-00005244.00000002.209294.06501000.00000002.mdmp, 00000000-00005244.00000002.209294.0679D000.00000002.mdmp, 00000000-00005244.00000002.209294.0A2A2000.00000002.mdmp, 00000000-00005244.00000002.209294.0A565000.00000002.mdmp, 00000000-00005244.00000002.209294.0AD01000.00000002.mdmp, 00000000-00005244.00000002.209294.11064000.00000002.mdmp, 00000000-00005244.00000002.209294.17A14000.00000002.mdmp, 00000000-00005244.00000002.209294.730A3000.00000004.mdmp") Found reference to API "K32EnumProcessModules" (Indicator: "EnumProcessModules"; Source: "00000000-00005244.00000000.205639.54ECE000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005244.00000000.205639.54ECE000.00000002.mdmp, 00000000-00005244.00000002.209294.04692000.00000002.mdmp, 00000000-00005244.00000002.209294.06435000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005244.00000000.205639.54ECE000.00000002.mdmp")6b:T7dd,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "bc1363062c4f4aff514d71fd85fc9a5a08ad7fc2ea9a40298bb8865d041b8a3f.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "bc1363062c4f4aff514d71fd85fc9a5a08ad7fc2ea9a40298bb8865d041b8a3f.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "bc1363062c4f4aff514d71fd85fc9a5a08ad7fc2ea9a40298bb8865d041b8a3f.bin") Found reference to API "|O:GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp, 00000000-00005244.00000000.205639.999D0000.00000004.mdmp, 00000000-00005244.00000001.207558.999D0000.00000004.mdmp, 00000000-00005244.00000002.209294.999D0000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp, 00000000-00005244.00000000.205639.54ECE000.00000002.mdmp, 00000000-00005244.00000001.207558.06962000.00000002.mdmp, 00000000-00005244.00000002.209294.04692000.00000002.mdmp, 00000000-00005244.00000002.209294.06435000.00000002.mdmp, 00000000-00005244.00000002.209294.06501000.00000002.mdmp, 00000000-00005244.00000002.209294.0679D000.00000002.mdmp, 00000000-00005244.00000002.209294.0A2A2000.00000002.mdmp, 00000000-00005244.00000002.209294.0A565000.00000002.mdmp, 00000000-00005244.00000002.209294.0AD01000.00000002.mdmp, 00000000-00005244.00000002.209294.11064000.00000002.mdmp, 00000000-00005244.00000002.209294.17A14000.00000002.mdmp, 00000000-00005244.00000002.209294.730A3000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005244.00000000.205639.54ECE000.00000002.mdmp, 00000000-00005244.00000002.209294.04692000.00000002.mdmp, 00000000-00005244.00000002.209294.06435000.00000002.mdmp")6c:T586,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "bc1363062c4f4aff514d71fd85fc9a5a08ad7fc2ea9a40298bb8865d041b8a3f.bin") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00005244.00000000.205639.0A2DC000.00000002.mdmp, 00000000-00005244.00000000.205639.0AD33000.00000002.mdmp, 00000000-00005244.00000000.205639.54ECE000.00000002.mdmp, 00000000-00005244.00000000.205639.999D0000.00000004.mdmp, 00000000-00005244.00000001.207558.0AB6C000.00000002.mdmp, 00000000-00005244.00000001.207558.17815000.00000002.mdmp, 00000000-00005244.00000001.207558.999D0000.00000004.mdmp, 00000000-00005244.00000002.209294.04692000.00000002.mdmp, 00000000-00005244.00000002.209294.06435000.00000002.mdmp, 00000000-00005244.00000002.209294.06501000.00000002.mdmp, 00000000-00005244.00000002.209294.0679D000.00000002.mdmp, 00000000-00005244.00000002.209294.0AD01000.00000002.mdmp, 00000000-00005244.00000002.209294.11034000.00000002.mdmp, 00000000-00005244.00000002.209294.11064000.00000002.mdmp, 00000000-00005244.00000002.209294.17A14000.00000002.mdmp, 00000000-00005244.00000002.209294.730A3000.00000004.mdmp, 00000000-00005244.00000002.209294.999D0000.00000004.mdmp, 00000000-00005244.00000002.209294.F6E46000.00000002.mdmp") Found reference to API "OO:GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp")6d:T1503,Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "bc1363062c4f4aff514d71fd85fc9a5a08ad7fc2ea9a40298bb8865d041b8a3f.bin") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "bc1363062c4f4aff514d71fd85fc9a5a08ad7fc2ea9a40298bb8865d041b8a3f.bin") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "bc1363062c4f4aff514d71fd85fc9a5a08ad7fc2ea9a40298bb8865d041b8a3f.bin") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "bc1363062c4f4aff514d71fd85fc9a5a08ad7fc2ea9a40298bb8865d041b8a3f.bin") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "bc1363062c4f4aff514d71fd85fc9a5a08ad7fc2ea9a40298bb8865d041b8a3f.bin") Found reference to API "O:GetFileAttributes" (Indicator: "GetFileAttributes"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp") Found reference to API "GetFileAttributes" (Indicator: "GetFileAttributes"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp, 00000000-00005244.00000000.205639.999D0000.00000004.mdmp, 00000000-00005244.00000001.207558.999D0000.00000004.mdmp, 00000000-00005244.00000002.209294.999D0000.00000004.mdmp") Found reference to API ":GetTempPath" (Indicator: "GetTempPath"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp") Found reference to API "GetTempPath" (Indicator: "GetTempPath"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp, 00000000-00005244.00000000.205639.999D0000.00000004.mdmp, 00000000-00005244.00000001.207558.999D0000.00000004.mdmp, 00000000-00005244.00000002.209294.999D0000.00000004.mdmp") Found reference to API "OO|i:GetTempFileName" (Indicator: "GetTempFileName"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp") Found reference to API "GetTempFileName" (Indicator: "GetTempFileName"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp, 00000000-00005244.00000000.205639.999D0000.00000004.mdmp, 00000000-00005244.00000001.207558.999D0000.00000004.mdmp, 00000000-00005244.00000002.209294.999D0000.00000004.mdmp") Found reference to API ":GetSystemDirectory" (Indicator: "GetSystemDirectory"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp") Found reference to API "OO:GetFileVersionInfo" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp") Found reference to API "GetFileVersionInfo:GetFileVersionInfoSize" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp") Found reference to API "GetFileVersionInfo:GetFileVersionInfoSize" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp") Found reference to API "GetFileVersionInfo" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp, 00000000-00005244.00000000.205639.999D0000.00000004.mdmp, 00000000-00005244.00000001.207558.999D0000.00000004.mdmp, 00000000-00005244.00000002.209294.999D0000.00000004.mdmp") Found reference to API "GetFileVersionInfo:VerQueryValue" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp") Found reference to API "GetSystemDirectory" (Indicator: "GetSystemDirectory"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp, 00000000-00005244.00000000.205639.999D0000.00000004.mdmp, 00000000-00005244.00000001.207558.999D0000.00000004.mdmp, 00000000-00005244.00000002.209294.999D0000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp, 00000000-00005244.00000000.205639.54ECE000.00000002.mdmp, 00000000-00005244.00000002.209294.06435000.00000002.mdmp, 00000000-00005244.00000002.209294.0679D000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp, 00000000-00005244.00000002.209294.0679D000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp, 00000000-00005244.00000002.209294.730A3000.00000004.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005244.00000000.205639.54ECE000.00000002.mdmp, 00000000-00005244.00000002.209294.06435000.00000002.mdmp, 00000000-00005244.00000002.209294.FCC1A000.00000004.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00005244.00000000.205639.54ECE000.00000002.mdmp, 00000000-00005244.00000002.209294.F6E46000.00000002.mdmp")6e:T5b8,Found reference to API "15396498204,1312,3146,,GetComputerNameW,kernel32.dll,"00:53:51.406",RX=0,PX=0" (Indicator: "GetComputerName"; Source: "00000000-00002864.00000001.206838.E9A50000.00000004.mdmp") Found reference to API ":GetComputerName" (Indicator: "GetComputerName"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp") Found reference to API "GetComputerName" (Indicator: "GetComputerName"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp, 00000000-00005244.00000000.205639.999D0000.00000004.mdmp, 00000000-00005244.00000001.207558.999D0000.00000004.mdmp, 00000000-00005244.00000002.209294.999D0000.00000004.mdmp") Found reference to API "GetComputerNameEx" (Indicator: "GetComputerName"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp, 00000000-00005244.00000000.205639.999D0000.00000004.mdmp, 00000000-00005244.00000001.207558.999D0000.00000004.mdmp, 00000000-00005244.00000002.209294.999D0000.00000004.mdmp") Found reference to API "i:GetComputerNameEx" (Indicator: "GetComputerName"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp") Found reference to API "GetComputerNameExW" (Indicator: "GetComputerName"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp, 00000000-00005244.00000002.209294.10C39000.00000002.mdmp") Found reference to API "GetComputerNameW" (Indicator: "GetComputerName"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp")6f:T593,Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "bc1363062c4f4aff514d71fd85fc9a5a08ad7fc2ea9a40298bb8865d041b8a3f.bin") Found reference to API "K32GetModuleFileNameExW" (Indicator: "GetModuleFileName"; File: "bc1363062c4f4aff514d71fd85fc9a5a08ad7fc2ea9a40298bb8865d041b8a3f.bin") Found reference to API "O:GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp, 00000000-00005244.00000000.205639.54ECE000.00000002.mdmp, 00000000-00005244.00000000.205639.988F0000.00000004.mdmp, 00000000-00005244.00000001.207558.988F0000.00000004.mdmp, 00000000-00005244.00000002.209294.11064000.00000002.mdmp, 00000000-00005244.00000002.209294.730A3000.00000004.mdmp, 00000000-00005244.00000002.209294.988F0000.00000004.mdmp") Found reference to API "GetModuleFileName" (Indicator: "GetModuleFileName"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp, 00000000-00005244.00000000.205639.98410000.00000004.mdmp, 00000000-00005244.00000001.207558.98410000.00000004.mdmp, 00000000-00005244.00000002.209294.98410000.00000004.mdmp") Found reference to API "K32GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00005244.00000000.205639.54ECE000.00000002.mdmp")70:T449,Found reference to API "GetEnvironmentVariableW" (Indicator: "GetEnvironmentVariable"; File: "bc1363062c4f4aff514d71fd85fc9a5a08ad7fc2ea9a40298bb8865d041b8a3f.bin") Found reference to API "O:GetEnvironmentVariableW" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp") Found reference to API "GetEnvironmentVariableW" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp, 00000000-00005244.00000000.205639.54ECE000.00000002.mdmp, 00000000-00005244.00000000.205639.999D0000.00000004.mdmp, 00000000-00005244.00000001.207558.999D0000.00000004.mdmp, 00000000-00005244.00000002.209294.04692000.00000002.mdmp, 00000000-00005244.00000002.209294.999D0000.00000004.mdmp") Found reference to API "GetEnvironmentVariable" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp, 00000000-00005244.00000000.205639.999D0000.00000004.mdmp, 00000000-00005244.00000001.207558.999D0000.00000004.mdmp, 00000000-00005244.00000002.209294.999D0000.00000004.mdmp")71:T8b9,Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00002864.00000000.206705.9CD30000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00002864.00000000.206705.9CD30000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00002864.00000000.206705.9CD50000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00002864.00000000.206705.9CD50000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00002864.00000000.206705.9CE10000.00000004.mdmp, 00000000-00002864.00000001.206838.9CE10000.00000004.mdmp") Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00002864.00000001.206838.9CD10000.00000004.mdmp") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00002864.00000001.206838.9CDB0000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00002864.00000001.206838.9CDF0000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00002864.00000001.206838.9CDF0000.00000004.mdmp") Found string "password" (Indicator: "password"; Source: "00000000-00005244.00000000.205639.04D81000.00000004.mdmp, 00000000-00005244.00000000.205639.9A7D0000.00000004.mdmp, 00000000-00005244.00000001.207558.9A7D0000.00000004.mdmp, 00000000-00005244.00000002.209294.0E25E000.00000002.mdmp, 00000000-00005244.00000002.209294.10B77000.00000002.mdmp, 00000000-00005244.00000002.209294.9A7D0000.00000004.mdmp") Found string "secrets" (Indicator: "secret"; Source: "00000000-00005244.00000000.205639.98210000.00000004.mdmp, 00000000-00005244.00000000.205639.98410000.00000004.mdmp, 00000000-00005244.00000000.205639.9AE10000.00000004.mdmp, 00000000-00005244.00000001.207558.98210000.00000004.mdmp, 00000000-00005244.00000001.207558.98410000.00000004.mdmp, 00000000-00005244.00000001.207558.9AE10000.00000004.mdmp, 00000000-00005244.00000002.209294.98210000.00000004.mdmp, 00000000-00005244.00000002.209294.98410000.00000004.mdmp, 00000000-00005244.00000002.209294.9AE10000.00000004.mdmp")72:T9dc,Found string "powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID"" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00005244-00000C46-21257521404") Found string "powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID"" (Indicator: " Win32_ComputerSystemProduct"; Source: "00000000-00005244-00000C46-21257521404") Found string "powershell -Command "(Get-WmiObject -Class Win32_BIOS).SerialNumber"" (Indicator: " Win32_BIOS"; Source: "00000000-00005244-00000C46-39598446786") Found string "powershell -Command "(Get-WmiObject -Class Win32_BaseBoard).SerialNumber"" (Indicator: " Win32_BaseBoard"; Source: "00000000-00005244-00000C46-57059604724") Found string "powershell -Command "(Get-WmiObject -Class Win32_Processor).ProcessorId"" (Indicator: " Win32_Process"; Source: "00000000-00005244-00000C46-74056275896") Found string "powershell -Command "(Get-WmiObject -Class Win32_Processor).ProcessorId"" (Indicator: " Win32_Processor"; Source: "00000000-00005244-00000C46-74056275896") Found string "powershell -Command "(Get-WmiObject -Class Win32_BIOS).OEMStringArray"" (Indicator: " Win32_BIOS"; Source: "00000000-00005244-00000C46-97953039626") Found string "powershell -Command "(Get-WmiObject -Class Win32_SystemEnclosure).SMBIOSAssetTag"" (Indicator: " Win32_SystemEnclosure"; Source: "00000000-00005244-00000C46-115265739382") Found string "(Get-WmiObject -Class Win32_BIOS).SerialNumber" (Indicator: " Win32_BIOS"; Source: "00000000-00002864.00000000.206705.CF050000.00000004.mdmp, 00000000-00002864.00000000.206705.CF300000.00000004.mdmp, 00000000-00002864.00000000.206705.E93D0000.00000004.mdmp, 00000000-00002864.00000001.206838.CF050000.00000004.mdmp, 00000000-00002864.00000001.206838.CF300000.00000004.mdmp, 00000000-00002864.00000001.206838.E93FC000.00000004.mdmp, 00000000-00002864.00000001.206838.E9482000.00000004.mdmp") Found string "powershell -Command "(Get-WmiObject -Class Win32_BIOS).SerialNumber"" (Indicator: " Win32_BIOS"; Source: "00000000-00002864.00000000.206705.CF050000.00000004.mdmp, 00000000-00002864.00000001.206838.CF050000.00000004.mdmp") Found string "HostApplication=powershell -Command (Get-WmiObject -Class Win32_BIOS).SerialNumber" (Indicator: " Win32_BIOS"; Source: "00000000-00002864.00000001.206838.CF07C000.00000004.mdmp") Found string "select * from Win32_BIOS" (Indicator: " Win32_BIOS"; Source: "00000000-00002864.00000001.206838.E9482000.00000004.mdmp, 00000000-00002864.00000001.206838.E9A50000.00000004.mdmp")73:T8c7,Found registry deletion API: "OO:RegDeleteKey" in "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp" Found registry deletion API: "RegDeleteKey" in "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp, 00000000-00005244.00000000.205639.999D0000.00000004.mdmp, 00000000-00005244.00000001.207558.999D0000.00000004.mdmp, 00000000-00005244.00000002.209294.999D0000.00000004.mdmp" Found registry deletion API: "OO|kO:RegDeleteKeyEx" in "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp" Found registry deletion API: "RegDeleteKeyTransacted" in "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp" Found registry deletion API: "RegDeleteKeyEx" in "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp, 00000000-00005244.00000000.205639.999D0000.00000004.mdmp, 00000000-00005244.00000001.207558.999D0000.00000004.mdmp, 00000000-00005244.00000002.209294.999D0000.00000004.mdmp" Found registry deletion API: "RegDeleteTree" in "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp, 00000000-00005244.00000000.205639.999D0000.00000004.mdmp, 00000000-00005244.00000001.207558.999D0000.00000004.mdmp, 00000000-00005244.00000002.209294.999D0000.00000004.mdmp" Found registry deletion API: "OO:RegDeleteTree" in "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp" Found registry deletion API: "OO:RegDeleteValue" in "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp" Found registry deletion API: "RegDeleteValue" in "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp, 00000000-00005244.00000000.205639.999D0000.00000004.mdmp, 00000000-00005244.00000001.207558.999D0000.00000004.mdmp, 00000000-00005244.00000002.209294.999D0000.00000004.mdmp" Found registry deletion API: "RegDeleteKeyExW" in "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp" Found registry deletion API: "RegDeleteKeyTransactedW" in "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp" Found registry deletion API: "RegDeleteTreeW" in "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp" Found registry deletion API: "RegDeleteValueW" in "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp" Found registry deletion API: "RegDeleteKeyW" in "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp"74:T59b,Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00002864.00000000.206705.CF050000.00000004.mdmp, 00000000-00002864.00000001.206838.CF050000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002864.00000000.206705.CF050000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\Device\"; Source: "00000000-00002864.00000001.206838.E9A20000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\DosDevices\"; Source: "00000000-00002864.00000001.206838.E9A20000.00000004.mdmp") Found string "\Device\HarddiskVolume2\bc1363062c4f4aff514d71fd85fc9a5a08ad7fc2ea9a40298bb8865d041b8a3f.bin.exe" (Indicator: "\Device\"; Source: "00000000-00005244.00000000.205639.96240000.00000004.mdmp, 00000000-00005244.00000001.207558.9C5E0000.00000004.mdmp, 00000000-00005244.00000002.209294.96240000.00000004.mdmp, 00000000-00005244.00000002.209294.9C5E0000.00000004.mdmp") Found string "m32\drivers\SandboxFltr.sys" (Indicator: "\drivers\"; Source: "00000000-00005244.00000000.205639.967B0000.00000002.mdmp") Found string "DOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005244.00000000.205639.967B0000.00000002.mdmp")75:T460,Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "bc1363062c4f4aff514d71fd85fc9a5a08ad7fc2ea9a40298bb8865d041b8a3f.bin") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "bc1363062c4f4aff514d71fd85fc9a5a08ad7fc2ea9a40298bb8865d041b8a3f.bin") Found reference to API "O:DeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp") Found reference to API "DeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp, 00000000-00005244.00000000.205639.999D0000.00000004.mdmp, 00000000-00005244.00000001.207558.999D0000.00000004.mdmp, 00000000-00005244.00000002.209294.999D0000.00000004.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp, 00000000-00005244.00000000.205639.54ECE000.00000002.mdmp, 00000000-00005244.00000002.209294.0679D000.00000002.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00005244.00000000.205639.54ECE000.00000002.mdmp")76:T1266,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "bc1363062c4f4aff514d71fd85fc9a5a08ad7fc2ea9a40298bb8865d041b8a3f.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "bc1363062c4f4aff514d71fd85fc9a5a08ad7fc2ea9a40298bb8865d041b8a3f.bin") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "bc1363062c4f4aff514d71fd85fc9a5a08ad7fc2ea9a40298bb8865d041b8a3f.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00005244.00000000.205639.0A2DC000.00000002.mdmp, 00000000-00005244.00000000.205639.0ABA7000.00000002.mdmp, 00000000-00005244.00000000.205639.0AD33000.00000002.mdmp, 00000000-00005244.00000000.205639.0B94C000.00000002.mdmp, 00000000-00005244.00000000.205639.10C67000.00000002.mdmp, 00000000-00005244.00000000.205639.54ECE000.00000002.mdmp, 00000000-00005244.00000000.205639.98410000.00000004.mdmp, 00000000-00005244.00000001.207558.06962000.00000002.mdmp, 00000000-00005244.00000001.207558.0A58B000.00000002.mdmp, 00000000-00005244.00000001.207558.0AB6C000.00000002.mdmp, 00000000-00005244.00000001.207558.0ADBA000.00000002.mdmp, 00000000-00005244.00000001.207558.0BA1B000.00000002.mdmp, 00000000-00005244.00000001.207558.0BA80000.00000002.mdmp, 00000000-00005244.00000001.207558.0BC6F000.00000002.mdmp, 00000000-00005244.00000001.207558.0E239000.00000002.mdmp, 00000000-00005244.00000001.207558.13A48000.00000002.mdmp, 00000000-00005244.00000001.207558.16AC6000.00000002.mdmp, 00000000-00005244.00000001.207558.16E83000.00000002.mdmp, 00000000-00005244.00000001.207558.17815000.00000002.mdmp, 00000000-00005244.00000001.207558.17AE3000.00000002.mdmp, 00000000-00005244.00000001.207558.98410000.00000004.mdmp, 00000000-00005244.00000002.209294.03E06000.00000002.mdmp, 00000000-00005244.00000002.209294.040D8000.00000002.mdmp, 00000000-00005244.00000002.209294.04692000.00000002.mdmp, 00000000-00005244.00000002.209294.06305000.00000002.mdmp, 00000000-00005244.00000002.209294.063D7000.00000002.mdmp, 00000000-00005244.00000002.209294.06435000.00000002.mdmp, 00000000-00005244.00000002.209294.06473000.00000002.mdmp, 00000000-00005244.00000002.209294.06483000.00000002.mdmp, 00000000-00005244.00000002.209294.06492000.00000002.mdmp, 00000000-00005244.00000002.209294.06501000.00000002.mdmp, 00000000-00005244.00000002.209294.0679D000.00000002.mdmp, 00000000-00005244.00000002.209294.067F6000.00000002.mdmp, 00000000-00005244.00000002.209294.08A03000.00000002.mdmp, 00000000-00005244.00000002.209294.0A255000.00000002.mdmp, 00000000-00005244.00000002.209294.0A264000.00000002.mdmp, 00000000-00005244.00000002.209294.0A281000.00000002.mdmp, 00000000-00005244.00000002.209294.0A2A2000.00000002.mdmp, 00000000-00005244.00000002.209294.0A552000.00000002.mdmp, 00000000-00005244.00000002.209294.0A565000.00000002.mdmp, 00000000-00005244.00000002.209294.0A5D2000.00000002.mdmp, 00000000-00005244.00000002.209294.0AADF000.00000002.mdmp, 00000000-00005244.00000002.209294.0AD01000.00000002.mdmp, 00000000-00005244.00000002.209294.0E25E000.00000002.mdmp, 00000000-00005244.00000002.209294.10B77000.00000002.mdmp, 00000000-00005244.00000002.209294.10C39000.00000002.mdmp, 00000000-00005244.00000002.209294.10F53000.00000002.mdmp, 00000000-00005244.00000002.209294.10F6E000.00000002.mdmp, 00000000-00005244.00000002.209294.11034000.00000002.mdmp, 00000000-00005244.00000002.209294.11064000.00000002.mdmp, 00000000-00005244.00000002.209294.119D6000.00000002.mdmp, 00000000-00005244.00000002.209294.11B82000.00000002.mdmp, 00000000-00005244.00000002.209294.144B3000.00000002.mdmp, 00000000-00005244.00000002.209294.14D96000.00000002.mdmp, 00000000-00005244.00000002.209294.16A38000.00000002.mdmp, 00000000-00005244.00000002.209294.16DC2000.00000002.mdmp, 00000000-00005244.00000002.209294.17A14000.00000002.mdmp, 00000000-00005244.00000002.209294.185B6000.00000002.mdmp, 00000000-00005244.00000002.209294.730A3000.00000004.mdmp, 00000000-00005244.00000002.209294.98410000.00000004.mdmp, 00000000-00005244.00000002.209294.F6235000.00000002.mdmp, 00000000-00005244.00000002.209294.F6E46000.00000002.mdmp") Found reference to API "Oi:TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00005244.00000000.205639.0AD33000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005244.00000000.205639.54ECE000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005244.00000000.205639.54ECE000.00000002.mdmp, 00000000-00005244.00000000.205639.98410000.00000004.mdmp, 00000000-00005244.00000001.207558.98410000.00000004.mdmp, 00000000-00005244.00000002.209294.98410000.00000004.mdmp")77:T6ab," HTTP/1.1 200 OK\nDate: Mon\n 25 May 2026 08:59:52 GMT\nContent-Type: application/json; charset=utf-8\nContent-Length: 58\nAccess-Control-Allow-Origin: *\nX-Ttl: 60\nX-Rl: 44 with response body ==>7B22737461747573223A226661696C222C226D657373616765223A22696E76616C6964207175657279222C227175657279223A224E6F6E65227D.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6a140f306a5d99b0f90c7983"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$50","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a140f306a5d99b0f90c7983"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at FAB60000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6a140f306a5d99b0f90c7983"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 0A550000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6a140f306a5d99b0f90c7983"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"