21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 5b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4cf,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample dc190c5e79ec… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample dc190c5e79ec…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 13/26 AV engines flagged this file. 14 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/dc190c5e79ec2eb371143beffe97cff1cee96945d14c14e92e4c31fba19cc314","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","dc190c5e79ec2eb371143beffe97cff1cee96945d14c14e92e4c31fba19cc314"],"about":{"@type":"SoftwareApplication","name":"tmppo9akxkh","applicationCategory":["peexe","assembly","executable"],"identifier":"dc190c5e79ec2eb371143beffe97cff1cee96945d14c14e92e4c31fba19cc314","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":13,"total":26},"behavioralIndicators":{"malicious":14,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:Tb3c,Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00006892.00000000.120784.04B30000.00000004.mdmp") Found string "Press Enter to continue...me of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00006892.00000000.120784.04B30000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00006892.00000000.120784.04B30000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00006892.00000000.120784.04B30000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00006892.00000000.120784.04B30000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00006892.00000000.120784.04B30000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00006892.00000000.120784.04B30000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00006892.00000000.120784.04B30000.00000004.mdmp") Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00006892.00000000.120784.04B30000.00000004.mdmp") Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00006892.00000000.120784.04B30000.00000004.mdmp") Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00006892.00000000.120784.04B30000.00000004.mdmp") Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00006892.00000000.120784.04B30000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00006892.00000000.120784.04B30000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00006892.00000000.120784.04B30000.00000004.mdmp") Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00006892.00000000.120784.04B30000.00000004.mdmp") Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00006892.00000000.120784.04B30000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00006892.00000000.120784.04B30000.00000004.mdmp") Found string "= Resolve-Path -LiteralPath $LiteralPath | Foreach-Object Provid'" (Indicator: "Resolve-Path"; Source: "00000000-00006892.00000000.120784.073F2000.00000004.mdmp")23:T536,"9iqmgvw,czc3000hd59z0wte,6" - Source: "00000000-00006892.00000000.120784.02B50000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006892.00000000.120784.02B50000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006892.00000000.120784.02B50000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006892.00000000.120784.02B50000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;se]l+>%ydigicert" - Source: "00000000-00006892.00000000.120784.02B50000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006892.00000000.120784.02B50000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006892.00000000.120784.02B50000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006892.00000000.120784.02B50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006892.00000000.120784.02B50000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006892.00000000.120784.02B50000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006892.00000000.120784.02B50000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006892.00000000.120784.02B50000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006892.00000000.120784.02B50000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0'4csk2pkcs=t+" - Source: "00000000-00006892.00000000.120784.02B50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006892.00000000.120784.02B50000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*laddtrust" - Source: "00000000-00006892.00000000.120784.02B50000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00006892.00000000.120784.02B50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00006892.00000000.120784.02B50000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006892.00000000.120784.02B50000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00006892.00000000.120784.02B50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006892.00000000.120784.02B50000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006892.00000000.120784.02EF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006892.00000000.120784.02EF0000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namead" - Source: "00000000-00006892.00000000.120784.04B30000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fe" - Source: "00000000-00006892.00000000.120784.073F2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006892.00000000.120784.073F2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006892.00000000.120784.073F2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft" - Source: "00000000-00006892.00000000.120784.073F2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>y" - Source: "00000000-00006892.00000000.120784.073F2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www" - Source: "00000000-00006892.00000000.120784.6F0B1000.00000020.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006892.00000001.121464.02BCB000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006892.00000001.121464.02BF1000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006892.00000001.121464.02BF1000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006892.00000001.121464.02BF1000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006892.00000001.121464.02BF1000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006892.00000001.121464.02BF1000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006892.00000001.121464.02BF1000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006892.00000001.121464.02BF1000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czc" - Source: "00000000-00006892.00000001.121464.02BF1000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006892.00000001.121464.02BF1000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006892.00000001.121464.02BF1000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006892.00000001.121464.02BF1000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;se]l+>%ydigicert" - Source: "00000000-00006892.00000001.121464.02BF1000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006892.00000001.121464.02BF1000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006892.00000001.121464.02BF1000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006892.00000001.121464.02BF1000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006892.00000001.121464.02BF1000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006892.00000001.121464.02BF1000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006892.00000001.121464.02BF1000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006892.00000001.121464.02BF1000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006892.00000001.121464.02BF1000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0'4csk2pkcs=t+" - Source: "00000000-00006892.00000001.121464.02BF1000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006892.00000001.121464.02BF1000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*laddtrust" - Source: "00000000-00006892.00000001.121464.02BF1000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00006892.00000001.121464.02BF1000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00006892.00000001.121464.02BF1000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006892.00000001.121464.02BF1000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006892.00000001.121464.073F2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006892.00000001.121464.08A10000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0^k*y-g&ui\l!e" - Source: "00000000-00006892.00000001.121464.08A16000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0listlist?);abnr(" - Source: "00000000-00006892.00000001.121464.08A16000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00006892.00000001.121464.08A16000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microocera7" - Source: "00000000-00006892.00000001.121464.08A16000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mpca_http://wel*jr1151137z0bsjbv4.0.30319" - Source: "00000000-00006892.00000001.121464.08A16000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00006892.00000001.121464.08A16000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbr" - Source: "00000000-00006892.00000001.121464.08A16000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0l*jrl*jr-ppkdppkdpkdphmmicrosoft" - Source: "00000000-00006892.00000001.121464.08A6A000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt06" - Source: "00000000-00006892.00000001.121464.08A6A000.00000004.mdmp")2d:T10e7,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00006892.00000000.120784.02B50000.00000004.mdmp, 00000000-00006892.00000001.121464.02B73000.00000004.mdmp, 00000000-00006892.00000001.121464.02BCB000.00000004.mdmp, 00000000-00006892.00000001.121464.08A16000.00000004.mdmp") Found string "ile:///C:/Windows/SysWOW64/WindowsPowerShell/v1.0/en-US/System.Management.Automation.resources/System.Management.Automation.resources.DLL" (Source: "00000000-00006892.00000000.120784.02B50000.00000004.mdmp") Found string ".Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00006892.00000000.120784.02B50000.00000004.mdmp") Found string "2,"System.Management.Automation Version=3.0.0.0 Culture=neutral PublicKeyToken=31bf3856ad364e35",0" (Source: "00000000-00006892.00000000.120784.02B50000.00000004.mdmp, 00000000-00006892.00000001.121464.02B73000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00006892.00000000.120784.02B50000.00000004.mdmp, 00000000-00006892.00000000.120784.04B30000.00000004.mdmp, 00000000-00006892.00000001.121464.02B73000.00000004.mdmp") Found string "System.Management.Automation" (Source: "00000000-00006892.00000000.120784.02B50000.00000004.mdmp, 00000000-00006892.00000000.120784.04B30000.00000004.mdmp, 00000000-00006892.00000001.121464.02BF1000.00000004.mdmp, 00000000-00006892.00000001.121464.04710000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00006892.00000000.120784.02B50000.00000004.mdmp, 00000000-00006892.00000000.120784.04B30000.00000004.mdmp") Found string "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00006892.00000000.120784.04B30000.00000004.mdmp") Found string "file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Management.Automation/v4.0_3.0.0.0__31bf3856ad364e35/System.Management.Automation.dll" (Source: "00000000-00006892.00000000.120784.04B30000.00000004.mdmp") Found string "System.Management.Automation.resources, Version=3.0.0.0, Culture=en-US, PublicKeyToken=31bf3856ad364e35" (Source: "00000000-00006892.00000000.120784.04B30000.00000004.mdmp") Found string "return [System.Management.Automation.CommandCompletion]::CompleteInput($inputScript, $cursorColumn," (Source: "00000000-00006892.00000000.120784.04B30000.00000004.mdmp") Found string "[System.Management.Automation.Language.Ast] $ast," (Source: "00000000-00006892.00000000.120784.04B30000.00000004.mdmp") Found string "[System.Management.Automation.Language.Token[]] $tokens," (Source: "00000000-00006892.00000000.120784.04B30000.00000004.mdmp") Found string "[System.Management.Automation.Language.IScriptPosition] $positionOfCursor," (Source: "00000000-00006892.00000000.120784.04B30000.00000004.mdmp") Found string "return [System.Management.Automation.CommandCompletion]::CompleteInput(" (Source: "00000000-00006892.00000000.120784.04B30000.00000004.mdmp") Found string "# .ExternalHelp System.Management.Automation.dll-help.xml" (Source: "00000000-00006892.00000000.120784.04B30000.00000004.mdmp") Found string "[System.Management.Automation.PSCredential]" (Source: "00000000-00006892.00000000.120784.04B30000.00000004.mdmp") Found string "$wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('New-Item', [System.Management.Automation.CommandTypes]::Cmdlet)" (Source: "00000000-00006892.00000000.120784.04B30000.00000004.mdmp") Found string "$wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('Out-String',[System.Management.Automation.CommandTypes]::Cmdlet)" (Source: "00000000-00006892.00000000.120784.04B30000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=MSIL" (Source: "00000000-00006892.00000000.120784.04B30000.00000004.mdmp") Found string "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\System.Management.Automation.dll" (Source: "00000000-00006892.00000000.120784.04B30000.00000004.mdmp") Found string "System.Management.Automation.dll-Help.xml" (Source: "00000000-00006892.00000000.120784.04B30000.00000004.mdmp")2e:Tf23,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00001540-00000C2A-842387075] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00001540-00000C2A-842712789] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00001540-00000C2A-842813506] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00001540-00000C2A-842871439] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00001540-00000C2A-843023177] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00001540-00000C2A-843052325] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00001540-00000C2A-843117661] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00001540-00000C2A-843199458] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00001540-00000C2A-843239005] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00001540-00000C2A-843306384] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00001540-00000C2A-843412444] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00001540-00000C2A-843550859] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00001540-00000C2A-843577387] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00001540-00000C2A-843637701] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00001540-00000C2A-843860524] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00001540-00000C2A-844817010] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00001540-00000C2A-844865105] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00001540-00000C2A-844891490] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00001540-00000C2A-845169520] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00001540-00000C2A-845566613] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00001540-00000C2A-845676743] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00001540-00000C2A-846744191] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00006892-00000C2A-849730355] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00006892-00000C2A-849921613] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00006892-00000C2A-850188771]2f:T52b,Found reference string ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\dc190c5e79ec2eb371143beffe97cff1ce" (Indicator: "add-mppreference"; Source: "00000000-00001540-00000C46-13421291538"), Found reference string "Add-MpPreference -ExclusionPath "C:\dc190c5e79ec2eb371143beffe97cff1cee96945d14c14e92e4c31fba19cc314.bin.exe"" (Indicator: "add-mppreference"; File: "powershell.exe"), Found reference string ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\dc190c5e79ec2eb371143beffe97cff1cee96945d14c14e92e4c31fba19cc314.bin.exe"" (Indicator: "add-mppreference"; Source: "00000000-00006892.00000000.120784.02B50000.00000004.mdmp 00000000-00006892.00000001.121464.02B50000.00000004.mdmp"), Found reference string "Add-MpPreference -ExclusionPath C:\dc190c5e79ec2eb371143beffe97cff1cee96945d14c14e92e4c31fba19cc314.bin.exe" (Indicator: "add-mppreference"; Source: "00000000-00006892.00000000.120784.04B30000.00000004.mdmp"), Found reference string "HostApplication=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\dc190c5e79ec2eb371143beffe97cff1cee96945d14c14e92e4c31fba19cc314.bin.exe" (Indicator: "add-mppreference"; Source: "00000000-00006892.00000001.121464.02B73000.00000004.mdmp")30:T13e5,"" (Indicator: "password"; Source: "00000000-00003196.00000000.120790.04B40000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00006892.00000001.121464.073B0000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00006892.00000001.121464.073B0000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00006892.00000001.121464.073B0000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00006892.00000001.121464.08960000.00000004.mdmp")46:T180a,"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00003196.00000000.120790.04B40000.00000004.mdmp\")","id":"string-836","level":"informative","mitre_attack_id":"T1213","name":"Able to perform SQL operations","origin":"File/Memory","relevance":3,"sources":[{"report_id":"6a0dfd854d11a265610e240e","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00006892)\n \"